This smells like a one-click bringup went wrong, and not that the Warrior software was compromised

Is that the story, or you are saying that the machine was secured correctly but that running Warrior somehow introduced your network to risk?

It should have been properly setup, but it was a couple years ago and I migth have left to much open. (it was on a VM behind a consumer nat, firewall router solution )