Seemingly it could have been scoped tighter.

But complaining about the methodology your (successful, free, overdue) penetration test is wild.