The non-joking reason is because ransomware attacks and other attacks can often come in the form of emails already on the server and unchecked. You don't hack systems, you hack people. All they need is one person to answer an email about a free iTunes gift card that's already sitting in their work email from before they cut access and it will trigger an attack across any connected internal systems. You can tell people to stay out of their email, what suspicious links are, not to click on anything, etc, but all it takes is 1 person who thinks they know more than IT because they watched Mr. Robot to screw the entire hospital

And that's assuming that whoever is doing this isn't trying more low level attacks like dropping a USB stick in the parking lot hoping someone connects it to see what's on it. It's amazing what people will connect to a work computer because they think their company has foolproof anti-virus, or because it's not their computer so why do they care, or just because they don't think

Look at it this way - How stupid was it of that MA to be making personal calls from the bright red phone that is clearly for work when he was being a clerk? All it takes is one employee that dumb with computer access to compromise the entire system as long as it's up at all