Ninety-nine times out of a hundred, defenders call attacks "genius" as a way of subverting accountability. What makes this particular incident pernicious is that it already had a built-in deflection of accountability --- the responsibility for ensuring that SolarWinds was fit for purpose was diffuse; hundreds of giant companies with large security teams all believed it was someone else's job to verify that SolarWinds could safely deliver its functionality.
I've worked with people who don't operate this way, and who take continuous flack from CIOs for spending resources on verification for COTS IT management tools. But those teams are, in my experience, very rare --- and the SolarWinds hack provides further evidence of that view.
It's not a perfect predictor, but a reasonable rule of thumb: if you've never heard of a vendor's security team, chances are they barely have one. That's obviously true of... most vendors! So you should be careful when you select one for a role as sensitive as fleetwide agent-based monitoring, where a vulnerability or a software supply chain fuckup is going to create mass compromise. This seems so clear to me that it barely counts as insight.