Not just paycheck. They had access to some or all of your company's internal system, code, and data for the duration. That's a much bigger threat.

I wonder how achievable this would be with even a deepfake filter?

A single person does remote interviews all day. The person who turns up is just some body to run the scam.

That said, as the saying goes that's a lot of hard work, to avoid working hard.