Because of a coffee change the path to utilize the hardware tRNG module was blocked and the software fell back to a shitty python library, but that never should have happened. This should have been written as a fail closed function, and when the hardware module didn't produce the entropy the device would have failed to generate a key. In that case it would have been identified in testing. They didn't write proper validation gates for their code. I'd say it's debatable how criminal it really is to simply guess a random number and sign a transaction on a public blockchain. Nothing was hacked and there was no unauthorized device intrusion. The keys were just easy to find in the number space. Possession of the private key is the only proof of ownership that exists in Bitcoin.