I don’t think this has to do with hacking, as in - if it were possible to hack a sc wallet, you could do that to all wallets, so why target a wallet with relatively low amount.
Most likely either that the person was sloppy while storing his keys, or entered them in a scammy site.
Still sucks and unfair! But nothing points towards self custody being hackable.
!DUO