The "email server" situation has received a lot of air time, so interesting to see some quantification of it. It will surely remain a hot button issue politically, I won't wade into that.
The relevant part of the story would center around the theme "security is hard". Avoiding such a high stakes endeavor seems a good idea, nonetheless the lessons about security apply to anyone running a personal mail server which is something I have been doing.
Turning on encryption, running behind a firewall, etc., seem like normal SOP and I do that. But it's hard to imagine meeting the way "over and above" requirements for securing a server for a high-level government official. Boggles my mind that anyone would take that on unless really knowledgeable about all the necessary procedures and having adequate administrative backup.
Definitely a bad place to be in the shoes of the folks who'd set up that system. Glad not to be there but worth learning from unfortunate high-profile mistakes.
