Test LP immediately drained by bots on Pancakeswap

I am trying to figure out what happened. A friend was testing a token he created on BSC and LP with PancakeSwap. Within minutes a bot drained the 4.8 BNB he used to create the LP. How is that even possible?

Here is the contract:

0xA1f28D87A3e85Af926DC5159E3e282b4d4ff1166