Also the type of the malicious content (rm -fr /*) is "easy" to spot in which I mean there are no rootkits or remote exploitable flaws added.

Not very nice to be a victim of that but at least there is no doubt whether you're vulnerable or not.

The timeline also suggests that the malicious content was made after the break-in and not planned beforehand?