Mark Karpeles isn't a stupid person, and he's an excellent coder from what I've read.  He could have easily been behind the bot all by himself, and I wouldn't put it past him to pull that kind of crap.  You're right about the poor maintenance and security and development.  I was just getting interested in bitcoin when Mt. Gox was imploding, and I never visited their website.  Now I kind of wish I had, just to see what it was like.

The infamous Mark Karpeles made a bugged php script and sent 2 609 BTC to broken address. As you can see below, one of these address start with "s-" but regular bitcoin address start with "1","3" or "bc1" :
https://blockchair.com/bitcoin/address/s-272edf45031dd498e7b3ae89e11ff21b
(more info here)