While Mt. Gox couldn't probably just take the money, there is nothing preventing him doing a rollback for example, or canceling whatever order he wants, including ones before the hack. For example, if in your account lifetime you only sent 1000 USD to your account, then by trading bitcoins you grow your account to 10000 USD, he could just say that he owns you only the original 1000 USD you sent to him, that everything else was a game. You couldn't do nothing in that case.
Would the rollback not make Mt. Gox insolvent? There were withdrawals during the incident. Unless they are funding from their own pockets, not everyone would receive all of their BTC if everyone withdrew at the same time. Correct?