This is how IT security traditionally works. There is a "need-to-know" basis around such things. IT admins often have access to highly sensitive information or data and need to keep it quiet.

Something such as a vulnerability shouldn't be discussed with too many people before a fix is made because word of mouth tends to spread quickly.

Kudos to the SteemIt team for keeping things quiet and quickly issuing a fix.