Those servers run by hackers who snatch coins that are sent to known private keys must have databases of many millions of addresses, I wonder if they run custom code that is much faster than Core because of its more narrow purpose.
Almost certainly. They don't need a wallet in core, and indeed, they don't even need a full node. A pruned node would suffice. They don't care about blocks or historical transactions at all - by the time a transaction is in a block it is already too late for them to steal. All they really care about is a way of maintaining a well connected mempool in order to quickly receive any newly broadcast transactions. For each incoming transaction, they will presumably have something like a huge lookup table database combined with one or more bloom filters to as quickly as possible determine if they have the private key for each address.