Can you answer the inexplicable?

An unauthorized individual accessed a Zoom meeting link between a host and one participant and attempted to hide with a third black/blank Zoom box labelled with the name of the authorized participant. The extra box was initially thought to have appeared due to earlier technical issues. The presence of the unauthorized individual eventually became known through chat messages directed toward only the meeting host. The uninvited participant was then booted by the meeting host. Upon viewing a video file playback of the meeting the uninvited participant, the third Zoom black/blank labelled box, is entirely invisible except upon being booted from the meeting the two other video boxes then drop down to a slightly lower position which was the only indication of the presence of the third individual. Can you explain how this invisibility occurred upon playback but not while live, i.e., it seems the playback should have shown the existence of that third Zoom box as appeared during the meeting.