It is quite obvious that it's a scam. They initially left a loophole for themselves, withdraw money and disappear. It means, they expected to withdraw funds in advance to avoid paying money to that hacker.
Get out of here with your newbie 1 post account. Stop creating new accounts and spreading FUD.
This function is clearly described in the whitepaper, and it aint no loophole.
I'll explain it in a simple way for your simple mind:
1. ETH address sends ETH to smart contract
2. Smart contract creates & sends SMART tokens to ETH sender address
3. SMART tokens can be 'traded in' and the ETH is returned to original address.
This function is available to anyone who sends money into the smart contract. By sending 1500 ETH to the contract the dev's are permitted to withdraw 1500 ETH and no more.