They almost have to, don't they? The privacy and trust implications are pretty high.
But I wonder, can their response be trusted? I mean, it's either malice or incompetence or a complete fluke accident, and the third one is the only one they'll admit to, right?
My bet is one coder fired and it's called out as an isolated incident by one bad actor skipping established policy. Whether that's true, well...
Malice is the first thought that comes to my mind. Perhaps a security vulnerability allowed somebody to access people's devices. It sounds exactly like the type of joke a curious hacker would play.
From our perspective, they have to.
From their perspective they don't and never will.
If it's a result of something shady they're doing, why would they release a post mortem instead of just letting the story die and let people forget about it?
Wow, you know, I never really thought about it, but this highlights the political premise that all postmortems are only expressions of either extreme shame or heroism, and perhaps only rarely honestly recount mediocre transgressions.