Audits since 2014 flagged weak passwords, outdated systems, and neglected upgrades at the world’s most famous museum.