The opsec of the people who eventually get indicted is always terrible. If you wanted to exfiltrate source code or docs, why the heck would you use the victim's own cloud storage product? You would just point a camera at your display and scroll through the desired materials, or use HDMI capture, or something along those lines.