I have no idea what happened. I expect any experienced attacker knows about remote lock and remote wipe, and their first step would be extract everything they can ASAP.

Then they can load the extracted bits onto something else and go forward from there.

> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.

It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.

Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.