This is the proper decision here, but not merely for the reason they've given.

The best reason the list should be widely available: The exploit has already happened in this case, and disclosing it doesn't help attackers do further harm; the harm is already done. Removing the list is closing the barn door after the horses are gone.