I know the plugin didn’t hack the site. The hackers who hacked the plugin did.
These same hackers hacked the site without the plugin. Now after 2 months of seemingly smooth sailing, the same hackers came back and hacked the Better WP Security plugin and now I don’t have access to the backend.