Ah! See, that makes much more sense, but I hope this isn't spin. ;)

So then next question, how come the vulnerability was unpatched?

Because it was all staged?

But then what about this : "The engineer's computer was compromised using a real zero-day exploit targeting an undisclosed piece of software. (Facebook promptly reported it to the developer.) It allowed a "red team" composed of current and former Facebook employees to access the company's code production environment. (The affected software developer was notified before the drill was disclosed to the rest of the Facebook employees)."

Does that mean they used the discovery of the vulnerability as an opportunity to create the drill (as a "might as well use this" scenario) or was the drill planned with the 0-day and then the developer was notified?

Which came first here, the vulnerability or the plan for the excercise? I would imagine priority would be to patch the system rather than plan a drill, no?

They could have planned out a drill and then waited for the first vulnerability they could exploit.

Edit: mkjones says they bought the 0-day: https://news.ycombinator.com/item?id=5199757

All very nice, but the article clearly says that they disclosed the backdoor to the developer after the drill.