How was BTCMITM20 able to reroute other peoples' transfer of funds to a different account?

So, according to my understanding, even if you send/receive bitcoin data using some internet forum wall for everyone to see, it'd still be completely confidential to everyone but the sender and the recipient, so how was this TOR attacker able to change the bitcoin address which their target was supposed to wire funds to, to another address of the attacker's choosing? Wouldn't the attacker have to know their target's private key in order to do so, and in that case wouldn't the whole thing be unnecessary and that they just simply empty the entirety of their victim's address to another address?