It seems to be an import pipeline bug. Photos does a lot of extra work on import (merging RAW+JPEG pairs, generating previews, database indexing, optional deletion), so my guess is a concurrency bug where a buffer gets reused or a file handle is closed before the copy finishes. Rare, nondeterministic corruption fits the profile.
Random is random, and random is clumpy, so maybe swapping parts is irrelevant, but... I wanted more detail how often the corruption happened throughout his replacement journey.
edit: also wth i just realized I went to "tenderlovemaking.com" at work. gross. lol.