Here, two bugs are chained for attack. First public burn function, and second lack of _transferFrom. Its a always best security practice to keep access controls over functions which can cause critical changes.

You can check similar attack scenerio here: https://twitter.com/cyberboyIndia/status/1521512468195213313