As described, the attacker quietly retrieved OAuth tokens from a single Heroku database, and then very loudly scraped GitHub. I'm not saying it would have been

As described, the attacker quietly retrieved OAuth tokens from a single Heroku database, and then very loudly scraped GitHub. I'm not saying it would have been impossible to detect the first action, but it's substantially easier to detect the second.