It's perfectly possible it's someone with deep domain experience, or someone who has product design or management skills. Regardless, dismissing these people out of pocket is not likely the best choice.
I'm no longer living in Oregon but remain closely connected. I can't opine to the behavioral challenges, but in terms of the raw score drop I think there's also the one-two punch here of:
1) Schools were closed from Covid for a long time. Not here to debate whether that was good/bad/otherwise, but it is factually accurate to say Oregon schools remained remote longer than almost any others in the country, and we now know the duration of closure had pretty direct influence on learning outcomes.
2) In the past decade the Portland metro area has seen an influx of migration from economically disadvantaged families who are immigrants / first generation citizens / non-native English speakers in the home. Students from these families are lagging significantly behind their peers in terms of post-Covid recovery, which if I recall correctly, follows national trends as well.
You can tell when this deal started to come together by looking at the history of the website on Wayback Machine. In fall of 2024, the website had a checklist comparing SDF to dbt and claiming SDF had a better feature set than dbt Core (page rendering is hit and miss right now for whatever reason):
https://web.archive.org/web/20240919110243/https://www.sdf.c...
My first employer is now a decently well known B2B SaaS and we didn't build user interfaces to manage various settings for a very long time. For example, we supported custom fonts, but we would have to jack into production to upload them and manually configure the database to make them available to a given customer. That ability didn't become customer-facing for a decade, simply because it was easier to file a ticket and make an SRE do it.
This is a little tangential but another good piece of advice is to avoid over optimization of the engineering stack. A giant monolith running on the largest RDS instance AWS provides a lot more runway than people realize.
In all of these advisories there has never once been a mention of cloud being vulnerable. I think it's safe to assume cloud runs a similar, if not identical, codebase, and that these issues are simply patched there first before vulnerability announcements are published. But that's the type of thing no company is ever going to be willing to say in public.