these are "smart contracts", and it's written into the code. Finding these relatively simple bugs are like finding a loophole in a law. In this case, the researcher found a loophole and then used that loophole to pay his/her self ~98K ETH.
The owners/ custodians of the coins or of the program managing the coin did not intend for you to have the coins or actually transferred the coins to you.
Even if they had a bug in their program that automatically transferred their coin to you and you didn't return it the law still generally considers that also as theft.
Contract law is only one part of the law.
There are myriad reasons legal reasons actual contracts are voided and thrown out in court as unenforceable, no consideration, illegal actions or unilateral negotation or even unfair terms etc.
You cannot have a legal contract which for murder for example.
It is quite catchy, "code is law". But law where? In some virtual crypto land?
Enforcement in this case is not LEOs but rather the smart contract that lives in the blockchain. Except there are no grey areas
it’s the responsibility of the smart contract creator(s) to make sure all edge cases are covered and thorough exhaustive testing is performed.
Exfiltration of coin by a bug is not any way the same. Government made the mistake in your scenario and you are let go, in this the owner of the property made the "mistake" .
It is no less a theft because someone kept the key to their house under the carpet and and you didn't have to "break in" literally .