Because they never actually hack anything. Either they fish someone’s password, find an email and password combo someone reusedfrom a different site, or someone left root with ssh access and a default password.