The process overall is not great, but ICANN's process didn't fail this customer. The customer needs to keep contact information up to date. If you own 100+ domains you should be very familiar and have your own process for managing this.
Its been this way since 2013.
The process to shut down a site is quite thorough in that many attempts at contact need to be made.
I'm a little surprised a phone call wasn't generated. By the time we've emailed you 3 times - we are making a phone call - we don't want to shut down a site if its at all avoidable.
This "24-48" hours stuff is nonsense - The suspension/un-suspension of a domain can be done almost immediately.
It remains to be seen but NameCheaps only potential issue here is whether they failed to renew the WHOIS privacy service.