Without going into details, post 9/11 and especially post 7/7 and then at multiple points since then, every 'large scale public event' has had to have serious reviews of its security.
Walk around the etihad hours before a game and other than the corporate/vip entrance, there's no way in. Walk around the London Stadium, same thing.
But apparently the swamp is just wide open to get into.
And somehow, despite hundreds of social media posts tagging them in, all of the related forums etc. talking about this protest, they didn't think to notify the police. Wait, no, they didn't want to pay the extra charge for the police to turn up.