Ross seemed to have had to learn about security from other people (meaning he had little/no prior knowledge about security) and was able to stay somewhat under the radar as a person holding massive amounts of bitcoin (for example he held 140k+ bitcoin on a computer that was not "cold") so he possibly employed a weak password and/or there was some vulnerability in his computer that would make any advisory somewhat easily be able to "figure out" what the password is