Are these spammers just lucky or is there something that lets them sniff blood in the water and specifically target people holding large amounts of crypto?

It wasn't a hot wallet, he had taken a photo of his seed and then left it in Google photos.

So your conclusion is sound but your premise is invalid.