Like some of the comments before me mentioned, I can see Upwork's rational in charging you. While you're "technically" an employee for them, us freelancers who use that platform also agree to different terms of agreement compared to typical employees.

In a sense, them charging you that much is more like a fee for using the platform on top of the usual service fees that they charge us anyway. A cost of using the platform which they consider their product they're selling to us (freelancers).

I don't agree with that way of thinking because as you've stressed, this is their mistake and they're looking for anyone at all to help them recover from that loss. Instead it would be smarter for them to take the loss on the chin (since they can afford to do so), and ensure something like this doesn't happen again by putting more security measures in place.