Someone gets your recovery phrase.
A phishing page, a photo in your cloud, a leaked backup.
In a normal wallet the funds are drained in one block. In Avelock the thief’s withdrawal waits the delay, and you cancel it.
They hold the phrase too, so they can cancel your withdrawals just as you cancel theirs — a standoff, not a drain.