Sam,
The snapshot is indeed not taken exactly at the point of failure as it's not technically possible. If you think about it, a failure occurs as a result of a WebDriver command (which in fact is a HTTP request between test JVM and a browser process) and a report is taken as a result of another WebDriver command (HTTP request) or many thereof if both screenshot and html reports are generated. Some time will obviously pass between these requests and there is nothing stopping the browser form executing javascript which modifies the page in that time.
The time between a failure and the reports being taken can be even increased if your test performs any cleanup. This is because report taking is implemented in cleanup method of GebReportingSpec which executes after the cleanup method of a spec extending it.