So someone has written program that quickly sends incoming BTC and is strictly connected to the network, right?
I think the answer is yes, and also, this kind of theft is not unique to Bitcoin alone, I actually think this started with Ethereum.
I remember when my first Ethereum wallet was hacked, what the op explain is what happened, as soon as transaction is getting confirmed, it is immediately sent out to another address, this is not something human being can do, human being can never be that fast.
A program written the Hackers is responsible for transactions.