The key leak could just as easily be incompetence. Accidentally committed to git, or in their travis setup in such a way as to be easily obtainable, or a bunch

The key leak could just as easily be incompetence. Accidentally committed to git, or in their travis setup in such a way as to be easily obtainable, or a bunch of other options. High effort for high reward like this is not surprising but it could all start with incompetence.