There is one more aspect of fraud the journalist has missed - chargeback fraud. Chargeback fraud is where companies try to lengthen the timeline of resolution of a fraudulent incident such as this one so that it exceeds your bank's official timeline for being eligible for getting your money back. Usually it's about 45-60 days and varies from bank to bank.
To me, as someone who worked in this industry before, this simply seems like a ploy by Deliveroo to escape absorbing the chargeback cost. Because, that is exactly what would happen if you called your credit card's bank/company and ask them to initiate a charge back for the fraudulent transactions instead of begging Deliveroo - the money will first be refunded to you almost immediately (varies from bank to bank) and then an investigation will be opened against the merchant in question (in this case, Deliveroo) and when you prove your credit card company valid proof that you're innocent by sharing logs, screenshots, etc. the dispute would be settled and the bank will side with you, the customer and thus this will lead to a loss on the merchant to bear the fraudulent transacted amount.
It seems, Deliveroo may be doing EXACTLY this to avoid letting the customer becoming eligible for a refund later through their banks by pushing them past the chargeback window. This is actually criminal in some countries, and grounds for a class action suit, which I hope someone sues them for if they are found guilty of this.
The other reason for the elongated resolution timelines is because Deliveroo actually benefits from these transactions - think about it, they earn for each transaction and in some markets, if I'm not wrong, the larger the transaction, the more they earn. So, why would they do something fast that affects their revenues negatively.
Anyway, my personal experience with Deliveroo also has never been positive and don't recommend them at all.