If they quietly brushed this under the rug - especially given the PyPI malware that was involved - it would be a huge scandal.
Disclosure is the only ethical response to this.
Ethical AI company ?
Is that a flock of flying pigs I see on the horizon ?
Then disclose to real organizations. Not twitter
The target audience of this blog post does not give a damn about PyPI. The affected parties get literally nothing from this post. They already disclosed behind the scenes, that was the ethical part.
Writing PR pieces competing to be the most dangerous model around (so give us money!) is the unethical part.