Shopee account compromised with no refund - anyone else experienced this?

Someone I know recently had their Shopee account hacked.

• Hacker made 12 transactions in minutes for “digital codes” worth about sgd$2k and deleted their account after.
• All the transactions went through PayLah directly at 4am hence they didnt see the notifications till later
• No SMS verification, no high-velocity transactions flag, no suspicious flag, no call-back, nothing.
• They immediately called Shopee on the day itself, but Shopee refused to refund even after the case went to small-claims & police. They asked the judge to dismiss the case because their terms stated to use SG arbitration, which costs thousands of dollars just to file.
• Mothership covered the story recently (search "mothership shopee")

Has anyone else experienced something like this with Shopee or other e-commerce platforms? Seems like a big loophole in their security that could happen to any of us. If big platforms can hide behind terms & conditions like this, what protections do consumers really have??