Why would a hacker add this code to each post, and how to do mass cleanup?

As I was using MariaDB, the following update did the fix:

update wp_posts set post_content = REGEXP_REPLACE(post_content,'(*CRLF)<noindex>.*</noindex> ','')

See https://dba.stackexchange.com/questions/234774/mariadb-multiline-regex/234778#234778

error code: 523