IIRC Holder, Comey, Rice, Brennan(?) and a bunch of other top officials had private servers or used public email for government business, to get around federal documentation regulations of email traffic. That were put in place by the Dems themselves.
This article goes all the way around the bend to try to keep from mentioning the multiple security violations that were ignored under the Obama regime.
So they blame the Chicoms, or the faceless coders. Anything to keep from implicating the men in the high towers.
That was true at the beginning before they got an SSL cert. I think that was about 5 months IIRC. But after that it was considerably more difficult to break into. It was "reasonably likely" that hostile actors gained access although that term was downgraded by McCabe/Comey/Strzok to "possible". But not simple. Not KISS.
This article goes all the way around the bend to try to keep from mentioning the multiple security violations that were ignored under the Obama regime.
As you point out a lot of the regulations were for record retention so that the Congress can have proper oversight. The main purpose of Hillary's server was to bypass recordkeeping. The other large set of security violations were related to stripping classification markings (or simply retyping parts of classified documents without any markings) for sending via her unsecure server. She encouraged the practice and set it up specifically so her underlings would do the dirty work, knowingly sending classified, and she would get the unmarked version for plausible deniability when she forwarded them to to uncleared people for personal gain.
That is all very KISS. Being pretty stupid she is ok with KISS. But the external hacking is not KISS. Nor is there evidence that Chinese intelligence assets could have been outed that way.