It's possible, but there are only a few reviewing systems that are commonly used and their permission systems are robust as far as I know. I think a simpler explanation is that someone in the fraud group has a "higher permission role" than a first-line reviewer, so has access to these. This could be someone who is a general chair, program committee chair, track chair or area chair if the conference is big enough, and often even senior PC members (the metareviewers). All they have to do is perform an export and put it on Dropbox or Google Drive.

It has been confirmed that the reviewing system in question is HotCRP, which is a very battle-tested system that is unlikely to have these issues.

There is a comment from Eddie Kohler on Twitter which implies this was not a leaky endpoint problem. You can see this thread for more details: https://twitter.com/xexd/status/1222659612857401344?s=20