Exactlyy. Swapping to XMR could have prevented the attacker from leaving a paper trail everywhere.
You're implying he did leave a trail but how would you know one of his transactions wasn't him swapping into monero? Your reasoning here doesn't make sense.
1