I wonder if something like that might be the case - that this malware escaped early or spread much farther and faster than the authors intended. That would explain the sloppy attempt at an analysis countermeasure that made it trivially easy to shut down the whole thing.

There is a pretty long history of worms proving way more aggressive (either in damage or spread) than intended. I wouldn't be shocked if a slow-and-profitable infection went wrong and set off a crisis response.