if I was nefarious and found a repeatable way to move bitcoin I wouldn't do it as I received the wallets phrases. I would Que up transactions in a batch & exploit all at once one large pull before the exploit could be identified.
Discussion
Yes, but you never know how low UTXOs will sit there without moving. If you find free money, you don't generally way for some other to turn up. You grab them and leave.
That's what exploiters do. They even push it a bit further...generally they fat finger the transaction fee, just to be sure to not being outbidden and to be included in the first block.
You're right for the general consideration that, if you're sufficiently sure that your victims are likely to let funds in their wallets long enough, you'll go for the patient path. But I would argue that's pretty uncommon and surely less incentivized than what'd happen with Nostr privkeys.