If you actually look at the House Intelligence Committee testimony from President Shawn Henry of Crowdstrike back in 2017 he clearly makes it seem as if they were never really 100% certain.
Here are some excerpts from his testimony:
"There are times when we can see data exfiltrated, and we can say conclusively. But in this case it appears it was set up to be exfiltrated, but we just don’t have the evidence that says it actually left."
"There’s not evidence that they were actually exfiltrated. There's circumstantial evidence but no evidence that they were actually exfiltrated."
"There is circumstantial evidence that that data was exfiltrated off the network. We didn't have a sensor in place that saw data leave. We said that the data left based on the circumstantial evidence. That was the conclusion that we made."
"Sir, I was just trying to be factually accurate, that we didn't see the data leave, but we believe it left, based on what we saw."
Asked directly if he could "unequivocally say" whether "it was or was not exfiltrated out of DNC," Henry told the committee: "I can't say based on that."
If you have no firewall or full packet inspection showing the data leaving the network, you cannot say it occurred. Clearly they could not confirm this so that is why he testified to that.