They had controls in place to prevent large transfers, so the attackers structured it as a lot of small transfers very quickly
Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
Be your own IRM 4.26.13!
If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.
The fact nobody thought of this is pretty staggering.