Nobody in the entire company should have access to move $billions in crypto, much less a random engineer, even if they're part of the deploy process.

They had controls in place to prevent large transfers, so the attackers structured it as a lot of small transfers very quickly

I mean sure, but as long as you can deploy directly any permissions models are meaningless for an attacker? They can just be removed.