It's easy to return money or apologize after the fact. Universities are going to attempt to take any free money they can get and not worry about it until there's a proven public outcry.
I don't think it's that simple. Due diligence is organizational security, and a good amount people have a lax attitude towards security.