IMO the title is a bit misleading since the bug was in the mev-boost library which isn't part of the ethereum protocol nor is it needed to validate blocks. As I understand, the "victims" were arbitrage bots that one could argue simply had their risk realized. I wonder if the brothers could have gotten away with it by just paying taxes.
Here is an in-depth post-mortem on the incident: https://collective.flashbots.net/t/post-mortem-april-3rd-202...
Earlier threads about this:
https://news.ycombinator.com/item?id=40369522