That explains the hacked accounts with the followers and payment options cleared.
But for the methods they use for hacking, I doubt that it would make much difference. The downloaded malware is not aware that it was downloaded by any itch account. It just steals what it can get and does whatever else the malware does. It surely targets itch credentials, stealing cookies and making 2fa ineffective.
If there is no root kit and escaping with it, at least sandboxing would protect the credentials.