I think the parents question was why they wait for the customer to do something instead of blocking/rotating the compromised credentials once they became aware of their existence.

E.g. I remember reading that Amazon even scans Github for AWS credentials proactively now, since this happened all the time.