Hackers stole authentication keys for @KeystoneWallet devices

Hackers managed to steal authentication keys for devices made by @KeystoneWallet I don't understand one thing here however. During manufacturing, as part of the factory self test in initial boot you have the device generate & save a private key on its own, and take note of the public key. If you have private keys to be stolen, it means that *somehow* a copy of the key exists outside of the secure element on the device? If the manufacturing process involves each device's private key existing outside of the device, there's something that needs urgent improvement. Have the device generate the key and include its own public key as part of its self test report, not the other way around.