The funds sent to users were "rewards" for using the platform. Compound didn't actually lose any user funds, it was Compound's "governance token" that was given out.
Although user funds were not affected, billions of dollars have been pulled out of lending pools in Compound.
It's really unusual for a crypto project to threaten users like this. Bugs happen all the time, heck, even giant thefts due to bugs happen all the time. Everyone usually just keeps right on doing whatever they were doing.
Unfortunately the bug didn't just hand out tokens to people, it did so by messing up the stored accounting for those "lucky" users. Fixing it is not going to be trivial. Also, the tokens that it handed out already "belong" to people who had "earned" them, but not yet cashed them out. This means that once this bug is fixed, Compound is going to take the funds for this out of their own treasury to refill this so users can be paid (or face some amazing backlash).
To change the smart contracts requires a community vote and a seven day period of review, voting, and timelock. This means that it's staying broken and handing out money for the next week, and people are racing to catch as much of it as they can.
It's an all round mess.