That was my first impression, but reading the original story from 2019 has a much less one-side pictures: https://arstechnica.com/information-technology/2019/11/how-a...

My other comment has more details, but a summary is that they the pentesters had been drinking before breaking into the building, were doing things that could be interpreted as being forbidden by their own contract, and the big one: The person listed on their authorization letter denied that they were approved to enter the building when called.

That last one is a big deal. If your own authorization contacts start telling the police you're not authorized to be in the building, you're in trouble.