Easier to probably hack the air defence or the missiles in flight..
I just realised reading this, Ukraine claim they shot it down, Russia claim it was their own air defence, but it could actually be both.
Prior to 2014 Ukraine and Russia used to carry out joint military exercises together including firing SAMs at drones, if Russia didn't bother changing the command codes for their S-300 batteries in Crimea (they're digitally interlinked systems and can be remote controlled by another unit) and some dude from the Ukrainian air defence forces happened to stumble onto some old notes from an exercise then they could have taken control of one and gone to town.