If the accounts were logged into from geographically similar locations at normal volumes then it wouldn't look too out of the ordinary.

The part that would probably look suspicious would be the increase in traffic from data exfiltration. However, that would probably be a low priority alert for most engineering orgs.

Even less likely when you have a bot network that is performing normal logins with limited data exfiltration over the course of multiple months to normalize any sort of monitoring and analytics. Rendering such alerting inert, since the data would appear normal.

Setting up monitoring and analysis for user accounts and where they're logging from and suspicious activity isn't exactly easy. It's so difficult that most companies tend to just defer to large players like Google and Microsoft to do this for them. And even if they had this setup which I imagine they already did it was defeated.