To me it just comes across as an attempt to deliberately confuse the issue.
> Dedicated journalists and security researchers have also helped to identify pre-existing ones.
Sure, you could translate that as "more eyeballs have uncovered our sloppy security" if you'd like, but it doesn't strike me as dishonest.
As an attempt to mislead or imply that there are no problems here, this is pretty much a failure, and thus not at all cunning.
> For the past several weeks, supporting this influx of users has been a tremendous undertaking and our sole focus. We have strived to provide you with uninterrupted service and the same user-friendly experience that has made Zoom the video-conferencing platform of choice for enterprises around the world, while also ensuring platform safety, privacy, and security. However, we recognize that we have fallen short of the community’s – and our own – privacy and security expectations.
Now, putting this into context as a software development team. Let's say your security/privacy team says "we really need to patch this CVE we found" and your infrastructure team says "we really need to re-architect this one area so we can handle more users". Given that Zoom has likely just doubled its user base (which means more revenue), where do you think management is going to spend its time?
This is coupled with the fact that a company with a ridiculous influx of users is going to be a higher value target. Security/privacy isn't going to move the needle in terms of revenue, but infrastructure is. It's a matter of contention of focus.
"If Linux had as many users as Windows 95, it would be just as buggy!"
Never thought I'd see it flipped around like this.