... they must now find at least one vulnerability in each of the firewalls.
It's not "pwn firewall A OR B", it's "pwn firewall A AND B".