The government acted too slowly to stop fraudsters exploiting its Bounce Back Loan scheme, a report says.