Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.

Unfortunately:

1) The dev downloaded it onto a work laptop which was really poor behaviour

2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.

3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.

But it is easy to be wise in hindsight.