Merck left the door open to a devastating cyberattack, missing two chances to raise a defense