Of course no system is completely bulletproof against a determined attacker. There are however a few differences. First of all what these people did is obviously illegal and people go to jail for doing that sort of thing. As it stands there is no legal consensus on whether exploiting a bug in a smart contract is illegal or not.

Secondly and more importantly, the fail-safes built into the system largely work. In the Bangladesh case for example the vast majority of the money they where attempting to steal was never transferred due to humans intervening and overriding the transfer order. And even a non-trivial amount of the money that was transferred was later recovered by reversing the transaction.