Which country? Your exchange or bank would not be compliant in the US. Money transmitters have a duty to determine the source of funds for large transactions. And they have to report any "suspicious activity" to authorities (FinCEN in the US). By the way, it's not necessarily a literal form, they can ask by phone or email for example. The specific details vary from country to country, like what amount threshold triggers the verification or what constitutes acceptable proof, but it's pretty standard thanks to the FATF[0].
This was in the US. SARs are filled out by banks, not individuals. I've literally never been asked for any proof from Coinbase for over 300k in transfers.
Coinbase does ask that. You can Google "coinbase source of funds" for confirmation. They even mention it in their user agreement[0].
You got lucky and/or maybe forgot that you supplied that information when you signed up. Sometimes it can just take the form of asking for occupation and income. It's possible that they didn't ask further proof if they determined that your transactions were not unusual given your declared occupation and income.
Fair enough, it is probably not unusual given my occupation. I would mention, though, that if the person in question stood to profit potentially millions of dollars as you mention, they can more than likely afford legal counsel to help them through this, rather than taking to Twitter.
[0] https://en.wikipedia.org/wiki/Financial_Action_Task_Force