You're right: it wasn't exactly a "best practice". I don't know how big his IT dept. would be with 72 desktops, but I would expect only one or two people, or perhaps a larger number working part-time. They probably had more important things to do (and I'll resist making the obvious joke).
There's no question that it was a mistake. But, did it really warrant a $65,000 fine and $35,000 in legal fees?
I know, glad you finally starting to catch on.