The government acted too slowly to stop fraudsters exploiting the Covid loan scheme, a report says.