When you frame it that way, it’s really not that different. The issue isn’t the access control system itself, more so that it’s really asking too much of people who don’t have the skills or understanding to manage it. Teams of trained professionals get it wrong when the scope is limited to a single application or suite of applications, and you think grandma is going to properly manage access control over her entire digital footprint?

I think that Microsoft would rather not acknowledge that one. It's much easier to hide behind a simple "bug" than to admit to such a massive security breach.