The game theory of "exploiting" the Zcash bug is much more complex.
"If the Zcash bug were exploited, we would have seen a large outflow from the Orchard pool."
No, it's not that simple.
A sophisticated hacker would not have just withdrawn from the shielded pool and sold tokens. Why? Because once they are out of the pool, there is basically no way to launder a large sum of money.
The orchard pool itself is actually the best way to launder counterfeit ZEC. The best scenario for a hacker is if (1) they remain the only party with counterfeit ZEC and (2) the Orchard pool remains in operation (not drained), so the hacker can launder the ZEC slowly (say, direct OTC within the Orchard pool over a longer period of time).
Can we rule this out? Yes, this can be ruled out if we ask most ZEC holders in Orchard to withdraw (i.e. drain the pool).
Another angle of attack that could have been executed which is hard to rule out: the hacker could have taken a large but ordinary-looking short position on ZEC after finding the exploit. This strategy is even plausibly deniable--you can reap rewards from knowing about the exploit early with little risk. Since there's a liquid perp market on ZEC, it's possible to "hide" a significant short position (worth millions) without moving markets significantly or leaving suspicious traces.
A sophisticated hacker could have run a combination of the two strategies above.