Buried deep in the article:

Hackers stole admin credentials for these devices.

So, yea, you have the creds, you can modify the OS any way you want.

It wasn’t because the devices were EOL (as implied in the beginning of the article), it’s because of poor credential management.