We had a really bad hire about 2 years ago. So bad it caused us to review our entire hiring process to understand how he got in. It took almost a year before he was fired (and he was a contractor so it should have been easier). In that time, he used up untold resources while we tried to find work he could actually do, people helping him "just in case he just needed a helping hand" and so on. Finally after wasting other people's time for 9 months, a manager made the decision to get him out.
A year later I got an email from him asking for a recommendation. Nothing ventured, nothing gained I guess.
Here I see the same logic that caused the TSA. Some rare and bad event happens, and people rush to rebuild the whole system to never let that happen again. Not even considering maybe accepting that rare and bad events happen and dealing with them more efficiently would be better? Maybe rebuild actually doesn't even prevent bad events, just specific type of bad event that already happened and is unlikely to repeat anytime soon? Maybe dealing with imperfection is better than trying to be perfect every time?
I.e., I don't know your particular situation, so I wouldn't dare to assume the reaction was wrong, but too often "we much at all costs make sure it never happens again" overwhelms any attempt at reasonable approach and cost/benefit analysis completely. Maybe getting one bad apple in occasionally is a reasonable price for quickly and efficiently hiring a lot of good people?
Because it's hard to fire someone. Lets discount the emotional cost completely and simply look at this in terms of financial risk to the company.
Employee X is hired. After a month it becomes clear to the whole team that X is a bad hire. But how do you turn a subjectively obvious feeling into an objectively obvious reason to fire. Because if that person decides to sue the company after getting fired that's what you will have to demonstrate.
Just imagine how hard it is to quantify what makes someone good at our job? Code Quality? Team dynamic? These are really fuzzy metrics.
You could document how many times the engineer affected production badly and how much that cost the company. But to be realistic even great engineers do that. Heck I touched production at Google and decreased revenue by millions of dollars and it was expected that this happens. So you'd have to let him affect the company enough times to be obvious He's worse than your other engineers.
You are going to have to have documented enough clear failures to do the job to justify starting the process of firing. If you don't have a performance improvement plan then you might be able to speed up the process a little. However not having a performance improvement plan is both a bad idea and, I would imagine (IANAL etc.), could cause problems later on down the road in a potential suit.
Taken in that light 9 months doesn't seem that long at all.