Yup, that is indeed insane. That's why my paranoia is good in a way, because if I need to do a big transaction (and I wish I had that kind of money to worry about things like this) I would never send 100 BTC at once, but in batches, or at least do a initial small transaction to see that everything is in order.
I think it was just a very random occurrence because the devs did not notice the bug was not fully patched for months. Bitman and bitgo handeled the situation very well. +1 for both those companies. I wonder how scared the poor guy was