I agree. I would like to seem more details of how they determined it was only crypto mining. Finding only mining scripts in your logs doesn't mean they were not running other code once they had root.
(The coin mining could be a cover like you mention, but it seems unlikely since it naturally draws attention.)
Not true; some PoWs such as Random-X are designed to be most efficient CPUs.