Yes, it's reasonable to think that their goal was to just inject the iframe and keep the pages running, but something went wrong and pages were pulled down to m

Yes, it's reasonable to think that their goal was to just inject the iframe and keep the pages running, but something went wrong and pages were pulled down to maintenance mode. This might also be what actually happened, but it wasn't noticed until after the maintenance pages were served and someone went looking at the source.