There was no rush for this disclosure on their side. And they publish at a point where they have not yet taken corrective actions:

    > Some of the solutions here may even be simple fixes;

They are still throwing ideas. Why have they not made those simple fixes yet before disclosing?