Why does phil21 necessarily have one wallet?

I find it doubtful that the majority of these heists follow anything like the pattern you've described. I think much more likely is just something simple along the lines of "xyz was active in Bitcoin in 2011, they're still using exchanges as of 2020 because we have a leaked email database, they probably have either nothing or a metric ton of coins, let's give it a go".

If anything I think that someone shouting loudly "I have definitely sold it all, I promise" is a sign that they probably haven't.