I don't know if I would call the attackers thieves. By the looks of things they aren't making off with bitcoins, they are just invalidating transactions that others are making, and thus making the db's of exchanges inconsistent with the actual bitcoins they possess. They are more like griefers.
There were two different scenarios involving the mutability.
The first was the attackers were ONLY modifying their OWN transactions. They would then report the tx failed, MtGox would lookup the tx id, see it wasn't in any block and pay them a second (and third? and twenty eight?) time.
After MtGox wised up 30 days later someone (possibly the same people, or new people) began mass modifying the tx of OTHERS. This particular event has no direct ecnomic value and your right it is likely griefers, or someone looking to damage the credability of the Bitcoin network. When people are talking about thieves they are talking about the former event.