I think his point is that the short interest is low, therefore it's not that heavily shorted, so if the attacker was doing the hack and shorting the stock to make money on the dip, he wasn't shorting enough to make that much money. Either that, or the attacker didn't short the stock in the first place.