From memory, and it's been a few years/models... but the GPIO pins, including the 5V input pin bypassed all of the circuit protection fuses and what-not the normal barrel jack had.
It wasn't uncommon for people to roast their RPi with incorrectly done, or poor quality GPIO powering devices.
This is still true. There are ample warnings to be careful when using the GPIO as input because of this. The hat probably passed on some variance that is supported by actual consumer devices and fried the RasPi because it has no protections.
From memory, and it's been a few years/models... but the GPIO pins, including the 5V input pin bypassed all of the circuit protection fuses and what-not the normal barrel jack had.
It wasn't uncommon for people to roast their RPi with incorrectly done, or poor quality GPIO powering devices.