I've just noticed that the iThemes Security plugin has a setting to restrict access to the REST API data. https://ithemes.com/security/wordpress-rest-api-restrict-access/

Not sure if it would have prevented this hack, but interesting nonetheless.