Test LP immediately drained by bots on Pancakeswap

I am trying to figure out what happened. A friend was testing a token he created on BSC and LP with PancakeSwap. Within minutes a bot drained the 4.8 BNB he used to create the LP. How is that even possible?

Here is the contract: