As someone that lives a largely anonymous life, not that I'm engaged in anything that would interest law enforcement, bullet proof operational security is impossible, and at some point mistakes happen. If you think it's easy, it's not.

https://en.m.wikipedia.org/wiki/Operations_security

Yes, putting your name in a Whois record is stupid, but just because that's what was publicly disclosed doesn't mean that's how they found him.

https://en.m.wikipedia.org/wiki/Parallel_construction