You don't have to use the frontend they host, it's not an actual single point of failure. Their frontend could go down, and as long as someone else is hosting one (or you download the source from github and host it locally) you can still use Badger.

If the failure of this single point led to the loss of $114m, that counts as a SPoF in my book regardless of what the platonic ideal user “could” or “should” have done.

You don’t even need the front end, you can interact with the contract directly.

It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds.

This is a failure of opsec.

presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF

it just happened to be an overly trusted point of failure