It was alwys stupid to presume that file timestamps “prove” that the files were copied to a thumb drive and not downloaded across the internet. First, because files that are stolen are usually zipped before downloading which preserves the timestamps of the local copying. Second because the speeds people say are impossible are easily doable.
Bill Binney differs with you. He’s a former IT architect at the NSA.