I found this explanation pretty convincing as to why there was such a dumb kill switch embedded in the malware:

"I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis"

From https://www.malwaretech.com/2017/05/how-to-accidentally-stop...