That'd make sense IF this attack was one that was along the lines of "Hey, I did an injection attack on the contract which caused it to do something bad".
However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code.
The technical and explicit intent was followed to a T here. The attacker got a loan (perfectly within the intent) bought a bunch of the index (again, within the intent) sold a bunch of a underlying stock of the index (Again, within intent), sold the index, and sold the loan. Nowhere in this process was there a "this violates the essence of the contract".
And, let's be frank here, it's not like the attacker didn't open themselves to a huge liability. Anyone that saw this attack in progress could have bought sushi coin or UCI and ultimately drained away the income this attacker was earning, potentially putting them on the hook for a pretty massive loan.
Now, would such a scheme be legal if this were actual securities and not crypto? Nope, because we put more protection around real securities in the US and other countries. However, crypto went out of it's way to make itself above the law and outside of securitifaction. That, in fact, was the entire point of crytpo, to be something governments COULDN'T regulate.