If they quietly brushed this under the rug - especially given the PyPI malware that was involved - it would be a huge scandal.

Disclosure is the only ethical response to this.

Companies post deeply embarrassing eng blogs all the time. See: every post about downtime or a security incident ever.

Right? 100% this is them trying to make gold out of turds.