It got hacked

Realistically, a plugin is only a small part of the security of your site. You site may have been compromised due to outdated scripts residing outside of the Sucuri plugins purview, other Admin users whose passwords were compromised, among other things.

Do you have other websites sharing the same hosting space?
That’s often something folks miss (scripts or other installs which share the same account).

Even the best security plugins, like this one, are at best an 80% solution on the best day.

Rating a plugin as a “1” because it’s not 100% effective is not terribly fair given the circumstances residing within and without WordPress security-wise.