[StuntPope]

Default behaviour in a registrar transfer is to leave the nameservers as is - the rar has to explicitly send a new ns set in the transfer call to effect a change.

Are you positive you didn't accidentally tick a checkbox or anything to use their nameservers?

[Ianvdl]

Yeah that's why I didn't expect anything to change - if I missed a checkbox somewhere I'd consider it to be a dark pattern, honestly.