You both are missing how the scam works. The til matches up with the expected amount.. and the counts match up. Because the cash is taken from the drawer for a REFUND, not simply skimming from the drawer. She authorizes a refund, but instead of giving the money to the customer, she just keeps it. Because it's services, not goods, there is no inventory to show up as missing when the refund is done fraudulently.
The point is the POS accounting and management of it should have flagged the behavior, or at least had better controls on the refund process itself. 'who is watching the boss' kind of oversight. Every refund would probably need an override, and so they can track who is authorizing the refunds. The lady probably knew what level of activity would tip off the alerts in the system and would stay under them.
Back in the 90s, the Disney POS machines spit out a summary report per cashier login. This report was used to reconcile the drawer. The cashier counts what's physically there, records it on a handwritten sheet (so many 20s, so many fives, etc) with the total, and the Working Lead turns it all in to a central Cash Control facility. There it's counted again, and if it doesn't match, the cashier would eventually get caught for having lied, so there are controls built in when it comes to just skimming money.
Back to the summary report. At the bottom it also listed how many refunds were issued and the total amount of those refunds, as well as how many overrides. A "refund" is when you reverse a transaction and hand cash (or credit card payment) back to someone on the spot. An "override" was when you pretend the transaction didn't exist, store the receipt for the Lead to later remove from the system, and re-do the transaction the correct way.
It required the Lead to issue a refund--cash on the spot. Overrides could be dealt with later; a cashier had the right to collect the offending receipt and store it a special envelope for this purpose, and simply re-start the same transaction with the Guest standing in front of them.
It is possible to have some very low-level theft with this system. If a cashier had a customer not want her receipt, he could keep the receipt in the Override folder, and the Lead at the end of the day would take that order out of the system, and the cashier could wait for the privacy of the "counting out" time at the end of the shift to pocket the $26.97 (or whatever) so that the cash matches the summary report. The Lead is unlikely to double-check in the system that a similar transaction was rung up after the offending $26.97, because who has time for that with every cashier?
But the Lead *should* scan the summary report really quickly. If there was four overrides and $100, you might well pause to ask about it. If you asked about it last week and the same cashier now has five, you might tell them a paper trail is coming their way if they don't operate the cashier more carefully. Click the button for "subtotal", which still lets you make changes, rather than jump straight to "total". Wait for the Guest to hand you money before you click "total".
For a cashier to have hundreds of dollars in overrides per shift means the modern day reports don't show overrides, or Leads aren't checking for them.
*note: doubtless, many of the specifics mentioned above aren't done in the modern company, like handwriting dollar amounts. Much more is likely to be computerized than was the case in my day.