It boggles the fucking mind that they didn't run a small-scale test, with enough money to make it worthwhile for people to test the contract, but not so much that it would have created all of this drama.
Spending $10,000 to test a project that I've heard is worth $150 million seems like a no-brainer decision.
The issue was a semantic bug in the code, which was exploited by an unanticipated usage pattern. It is hard to catch this kind of error with testing, since the programmer is usually the one writing the test.
It is also (often) hard to catch subtle semantic bugs in code review too, unless the reviewer is looking for a known pattern of semantic bug.
There are some interesting things happening as a result -- formal verification, etc., but I am hoping that we end up seeing the emergence of an insurance market on smart contract behavior...
"Here's a box, it has $10,000 in it. If you break it, you get $10,000 worth of Ethereum."
Ahh. Yes, that would have been an excellent thing to do. Even a binary future on "will the DAO be hacked" would have quickly revealed (via its price) the true risk, well before the dollar figure got so high.