That's fairly risky, though, as it's very visible to users if it goes wrong, who could then alert the manufacturer, who could in turn warn other users.

I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.