Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies

Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation. It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.