Low cap projects have always a high risk to be hacked. Not only because requirements to compromise it are low, often techical code for such projects are not proven enough because low cap projects can't afford high quality developers and very important don't have a good peer to peer review.
Low cap projects are often a big experiment and people buying it will have a big risk to be affected of a flawly programmed code.
Thorchain is not a low cap coin, a project of $920m market cap is no where regarded as low market cap project, any project can be hack, sushi was hacked despite being a strong top coin, when the creator returned $14m after the causing a huge crash, we've seen several hack from top coins and I think this might not be the end, as of Thorchain I ain't suprised about it, but I'm glad as they contain the whole panic