Did anyone investigated deeper where the coins might be going?
How? The coins moved to brand new Bitcoin addresses. There's nothing to link them to.
In the past, even the most sophisticated scammer have made errors, even after multiple coinjoin runs, and got caught.
The size of the theft was bigger thou, so it was the willingness of the entity doing blockchain analysis.
I am not a fan of the on-chain heuristic, but blockchain footprints are immutable and available to be analysed with newer techniques for eternity.
Never say never.