To stress the point to breaking, the issue is not the tagging, it's the security breach. The issue is not how easy it is to clean graffiti off a train, it's the consequences orf something has potentially been put on or in the train, or has otherwise interfered with. Even to bring it back to tagging as the cause of concern, I assume taggers don't really care if they step on an area of the train that is clearly marked "no step" while in pursuit of their vandalism, causing damage that may not be visible to a simple visual inspection or even a start up test, and might not even reasonably be part of a check for damage in transit inspection.
Although historical, there is iirc a train accident where the immediate cause was a single incorrectly set brake valve, externally accessible. Brake systems are safer nowadays, but of course, adding to the risk is that this was a newly delivered unit that is still being commissioned, and it is not unknown in the early phases of commissioning to not have all the train's systems in operation.
That's but one example. You can stretch the what if point in all manner of ways when you play out all the possible scenarios arising from this breach, and believe it or not, doing so is the job of a security analyst (and of course, the Stadler manager doing a risk assessment of the transit arrangements).
Nexus can and probably should reject any unit where they are made aware of an insecure transit of potentially significant impact, for the above reasons. Which is why it will always be cheaper and easier to ensure you are being as rigorous in your transit arrangements as you apparently are in your design process.
The complexity of the delivery arrangements, especially if it apparently leads to simple failures in security like parking the unit in an unlit siding, does unfortunately speak to the quality of the company's planning or execution of its basic business processes.
As for potential design flaws that will only arise in service, like Hitachi, this may be a gross simplification that offends many here, but to merely illustrate the point, people unfamiliar with the system might see the word Metro and see the relatively lightweight units crawling though level crossings and stopping at prefab street stations, and make assumptions about things like chassis stresses and component specifications.
The reality is, when you see these things in action, particular lineside, you see the speeds and the stresses they are subjected to on certain stretches, compounded by their mass transit usage, and realise that in many ways, they can and should be considered main line multiple units. It is essentially a unit that needs to be both a main line unit and a Metro unit, powered from overhead lines. Oh, and it also goes through long tunnels, so needs to be a subway unit too. It can hit cows and horses, cars and pedestrians. It can be eaten by doormice and rats.
It carries bikes, wheelchairs and suitcases. It crawls and it flies, it rattles and rolls. Just as with Hitachi too, these units need to safely interact with other electrical systems belonging to the mainline railway, and indeed, presumably many domestic and industrial installations, squeezing between the ever growing estates with their solar and heat pumps and all that jazz.
For all those reasons, and many many more, and with the basic assumption that Hitachi, the Japanese having invented the sort of design and manufacturing assurance systems needed for such bespoke products, still having failed in a spectacular way, I have my doubts there is any wholly analogous systems in the world, even less so when looking for a system Stadler might have recently supplied. I stand to be corrected if that was considered as part of the bid, but I don't recall that it was.