This would have likely been caught in a standard audit. Flashloan attacks are incredibly well known and any auditor worth their salt will examine those scenarios
This was not a standard attack though. It was a genuinely new attack vector that's not been seen before. Flash loan was just one hammer in the attacks toolbox.
Remember anything a flashloan can do, a whale can do too.