Security departments are there to protect against threats to the company. Bad publicity is a threat for companies. So never expect some company official to admi

Security departments are there to protect against threats to the company. Bad publicity is a threat for companies. So never expect some company official to admit that there is a glaring hole in their security, until they are very, very sure that they have fixed it. Fixing a hole likes this can take a lot of time because you need a lot of testing. Apple is not going to tell the rest of the world what they are doing exactly because of possible bad publicity. When they have fixed the problem there are very good reasons for Apple to downplay its importance, which implies that they should pay some money but not too much.