Without knowing the cause, it's hard to lay the blame. It appears to be a "legitimate" transaction which means compromised keys and possibly an inside job. Securing keys is not about blockchain tech - it's about best practices in a live environment with multiple possible threat vectors.

This type of thing will continue to happen because security is viewed as a cost center, not a revenue generator. An organization has either not taken the time (time is money, right?) or refused to spend the money to do security right.