That doesn't answer the question: what should they have done instead? We struggle with this at our company all the time. It's very easy to point out the shortco

That doesn't answer the question: what should they have done instead? We struggle with this at our company all the time. It's very easy to point out the shortcomings in any course of action, because these kinds of decisions almost always have trade-off. As pointed out, the alternative was to leave potentially compromised packages online. If you do a risk/outcome matrix analysis on this decision, they clearly made the right one.