I've never seen a case where outsourcing of general-purpose IT things saves money over the long-term. It might make the budget look better for a year or two. Which, I think, is the motivation for a lot of the people making decisions to outsource. It is cheaper right now, so who cares about later?
Special-purpose stuff can still be cheaper to outsource, though. If I need something to work next week and it would take my staff a month to get up to speed, I'd spend the money on outsourcing it.
I can't speak for a current safe limit, but it isn't very hard to transfer funds between various cryptocurrencies. Tumbling is not secure with a large amount of coins. All you have to do is monitor all transactions and figure out what went in and what came back out. If you start splitting things off in small amounts on various blockchains things become much harder to track.
This is assuming the attackers know what they are doing. I would be against that.
No matter who they wrote this article about, a family did get doxxed and they do have the last name Nakamoto. I don't see this as a confirmation from Gavin. Has he said anything about this since that tweet?