It is almost never a clever attack. It is an abandoned plugin, a reused password, and a backup nobody tested.
