"There was some weakness in the system, and the bitcoins have disappeared."

They've "disappeared". Curious choice of words.

Karpeles didn't say they were stolen, or misplaced, or destroyed. And he didn't say when the mysterious disappearing act occurred.

The most likely explanation is that Gox's crappy system lost the private keys to cold storage long ago, and they've been running fractional reserve since then, hoping to close the gap.

Transaction malleability was probably an insignificant fraction of the loss.