This is my problem with the piece. In general, these stories aren't "day 0 exploit compromises website, company responds quickly". These are companies failing

This is my problem with the piece. In general, these stories aren't "day 0 exploit compromises website, company responds quickly". These are companies failing to enact the basic security practices taught in introductory college courses. They're companies disclosing a breach six months after it happens, just before (or after) independent researches make it public. If a few of these companies have used best practices and been caught with new exploits, they deserve to be given kinder news stories than the usual. In practice, though, the story is almost always one of neglecting even basic security.