I was at the Scotland match at the San siro about a week before this incident (don't even ask me the score!.)
A flare was thrown into our end too, promptly thrown back by a brave Scotsman. It landed on a plastic seat and reportedly blew it apart.
The police at the stadium, who I witnessed having a beer and a cigarette just before kick-off, were not visible inside the stadium during the match, there were no stewards to be seen either. Italian fans had managed to get a scooter past security a few weeks before.
While they ban fireworks, belt buckles, firearms and blades, there is no mention of a ban on flares.
They seems to have the mentality of locking everyone in and letting them get on with it. They locked the Scotland fans in for about an hour after the end of the match to let the Italians disperse.