No flash photography is definitely repeatedly announced before the ride, along with keeping hands and arms inside the boat, etc. The basic rule is if the attraction is indoors, no flash pictures. Common sense really.
While on PotC, I have heard CMs make "no flash photography" announcements, but it's very rare. It's very effective though. When they do actually do it, it almost always stops the problem.
As for the original post, assuming it is true, I suspect somebody was asleep at the wheel. I've heard CM announcements made when somebody was just putting their hand in the water, so I don't buy that somebody could do what these guys did without being detected, unless somebody wasn't paying attention.