A hacked Joomla website needs both cleanup and hardening
When a Joomla website is compromised, the obvious symptoms are usually only the visible part of the issue. There may be hidden code changes, damaged extensions, SEO spam, broken site behavior, or wider security weaknesses that made the intrusion possible in the first place.
That is why the work should not end with visible cleanup alone. The site also needs stronger protection so the same type of incident is less likely to happen again.