> We discovered and immediately patched this bug in March 2018.

I do believe the problem here is that they didn't disclose it in March or April. Disclosing it six months after the fact does not help trust.