I think the issue is the money wasn't stolen, the attacker saw a loophole and used it, it's shitty but it's like if a store was giving coupons giving you a free orange and then you get lots of coupons and clean the store out of oranges.
The store owner might say, I meant to write "one per customer", then you say "should've, but didn't".