Very well done to all within the Nabu Casa team.
Handled as best as can be given the situation.
And as others have mentioned, yes, giving enough information to cause users to bring about action, but not enough to tip off potential bad actors on how to look for said exploit, that was the right call.