Which of the two do you think will more likely come back to haunt you? The one where any authorities investigating will need to dig up the backgrounds and connections of hundreds of blockchain addresses exploiting the transaction, or the one where only a single address exploits the transaction? Won't their attention be primarily on those idiots who try to withdraw the money in the US, say, vs that one transaction out of hundreds where someone in Barbados had their proceeds deposited into a bank and withdrawn as cash before closing the bank account (that they opened with a false identity, maybe?).

When there's a single account performing the exploit, all of the investigative resources will be applied immediately to that account, making it far more likely that the account in question will be tracked up to the point of withdrawal, and potentially flagged in time to prevent such a withdrawal. With hundreds of others distracting any authorities, it becomes hundreds of times harder track down the original perp.

Think of those heist movies where someone throws a handful of cash up in the air to help avoid pursuit. Same idea.

There was another bug where someone tried to grab the coins without broadcasting the bug into the pool (by using a well designed double transaction), but they made a slight mistake, and other traders immediately took the coins instead by algorithmically detecting the bug (as soon as the example transaction was published on the blockchain) then algorithmically generating transactions.

Also: https://en.m.wikipedia.org/wiki/Hanlon%27s_razor