Comment by jtraub

I think they can just temporarily turn off password reset to prevent account stealing. After that they can take their time to fix the problem, test it and roll out to the public.