1. They don't actually know if the breach was exploited, because of the limited log window.
2. It appears that Google intentionally avoided the congressional hearings last month because of this breach, if they asked a question such as "are there any other incidents you have not disclosed" they would have had to either perjure themselves or kick off a PR fiasco in front of lots of TV cameras in real time. When you're evading authorities because of an incident like this it's far worse than any hack itself.
Maybe it is high time for software companies to start disclosing internal vulnerabilities (whether they can demonstrate it has been exploited or not) in light of the massive, worldwide societal impact these companies now have.
People everywhere should be mad as hell that these mega corporations are so powerful that they regularly evade oversight to continue building their monopolies. It's not about disruption or innovation anymore, it's become something far more evil.