Actually.... it is because of negligence.

Allow me to explain why.

Firstly the initial exploit was indeed via a plugin for the imaging program they used, the plugin had too much permissions and thus created the exploit, that was patched and would have been the end of the issue completely.

But.... from that exploit a hacker obtained a copy of the entire code that FA runs on, the same code that everyone knows is buggy to all hell and has more holes in the security then swiss cheese, yes there was a USB drives with FA's code laying around at a furry convention, FA staff knew this before the attack, this is the part that negligence and incompetence comes into effect, at this point after discovering that their site code was compromised they should have taken the site offline and worked to patch the code for however long it took to patch the major and easy to spot holes, but they didn't do that, instead they waited and an attack happened, the moment this occurred the site should have again been taken offline, but for whatever reason they gave the hacker time to start deleting everything before they finally took the site down to stop any more data from being lost, however the damage was done, forcing the staff to have to use a saved back up, problem is this back up was a week old, so data was still lost anyway, either way you look at it the hacker accomplished to delete data successfully.

Again at this point it would have been all said and done and over, but it gets worse, staff claimed that there was "no reason to believe that users accounts were compromised." but they still suggested that you change your password, two days after the first attack user accounts were reported as being compromised, this forced the staff to quickly put the site into read only mode where it still currently is at.