To me, it boils down to incompetent auditing of the contract code.

Arguably things like this should make the future a bit more secure, from what gets learnt. In the same way other code industries learn from found bugs or exploits.