Possibly yes

Or some part of their system failed and the key was compromised without them realising it (like the Debian insecure keys debacle or whatever)

The wallet is a smart contract (specifically a gnosis safe), the malicious message they signed transferred ownership of that smart contract wallet to the attacker so they could then do whatever they want with it.