One speculative (IMO plausible) timeline for recent events is:
1. USDT is printed out of thin air over a long period of time, and there's grumbling about it constantly, but nobody really does anything.
2. Someone looking to affect the BTC price grasps onto the above issue and spams social media about it. Eg. "Check out what this one guy says will crash Bitcoin to $0.01, you won't believe what this company did!".
3. Due to the spam, a USDT bank run starts, but USDT runs out of actual money.
4. To buy time, USDT creates the "theft transaction" as an inside job. This creates an excellent and essentially irrefutable excuse for stopping further withdrawals.
Tether appeared to be fairly legitimate as of a year ago. Lots of people used it to arbitrage the markets, they had a standard KYC process and standard bank wire service.
It wasn't until March of this year -- when both Bitfinex and Tether lost banking capabilities -- that things started to get really fishy. For one thing, did they "lose banking capabilities" or are they insolvent? We'll never know, and while Friedman LLP has apparently looked at Tether's books, their statements don't confirm that Tether has access to funds backing all USDT in circulation.
The "theft transaction" narrative seems unnecessary, since nobody can withdraw USD from Tether (or Bitfinex), and they haven't been able to for many months now. Then again, who would be dumb enough to bother hacking Tether? It's centralized; they can just freeze your funds and/or fork the network.