I'm just glad I find my son. I'm not going to blame anyone (I just think the CM's handled this terribly.)
One can do everything right. You can have your child's name and phone number printed on his forehead, you can put him in a harness, you can do lots of things, but if they do get away, it only takes one sicko a few minutes to get them out of the store and into their car in a matter of minutes.
You do know this risk is infinitesimally small right? It really isn't something to dwell on or loose sleep over or excessively scare our children over.