
Some people don't understand that you can't so easily get rid of files off a flash drive.
If you delete them, they can still be recovered as was already known about many kinds of media but with flash memory even if you try to overwrite the file you have no reasonable expectation that typical overwriting software will circumvent the wear-leveling of the flash controller. It'll do what appears to be overwriting then simply re-reading all sectors later the data may be retrieved unless the flash drive is either destroyed or filled with enough data to be sure the old was overwritten.
Even then someone will come along and say there are ways to detect what was previously written but in the real world such measures are more of a theory based on simple principles, not a working viable method if the data was actually overwritten on flash.
The better question is why was the bot ever stored on any media the perpetrator had at all without strong encryption. There was no assurance that days or weeks, letalone several months later would be a period available to dispose of the evidence. Feds don't generally give advanced warning before the knock on the door in the wee morning hours.