The recent exploit hackings could have been way worse.

Supposedly you can avoid rollbacks by hiding items with duey. Since the items remain in limbo inside the system for a day, it's hard to say if absolutly everything gets rolled back.

This only applies when they do direct queries to modify the database, not a true rollback. Because they're only hitting the tables they specify if they don't manually include the storage tables they get missed. Inventory, equips, boxes, cash shop and so forth are all separate tables in the same database.

A full/true rollback is when they literally drop the entire database and reload it from another day's backup.