"Google said it had detected the alleged theft through routine security monitoring", so it seems it is possible.

Note the "also" in the first sentence. I'm understanding the timeline as them trying normal exfiltration, getting caught by DLP, then moving on to the cell phone method. But the first catch was enough to trigger an investigation.