> because it means customer secrets were indeed compromised.

It does not mean secrets were compromised. It means: If there is a risk customer secrets were compromised, the right thing to do is to assume they were and refresh everything. Even if there's no evidence of it.