For what it’s worth, the latest status updates from Microsoft address this concern: “At this time, we have no evidence of malicious activity associated with this incident.”

Abscence of evidence vs evidence of absence notwithstanding, it’s probably best not to overly speculate.

I think the "at this time" is important, they were probably more focused on bringing everything back rather than doing a full investigation. I'm curious about the post mortem.