I can guess Defi peeps are busy counting money and watching stats instead of logs - I would think some sort of heavy signal monitoring for abnormalities (users complaining for example or even changelog on Cloudflare end) would have alerted them before the damage got to 100m.