Companies are people. And all the relevant parties involved in handling this may not be accessible to make a decision as quickly as needs to be done. Or at least quickly enough to satisfy all people.
Do you feel you suffered any harm in particular by the delay of three days?
What I would love is an update whenever they suspect an intruder has accessed sensitive information. Many websites like Dropbox and last.fm do have a server status where they tell us if they have any planned maintenance or just general status of the server. Why can't Apple and the rest of the big companies do that?
Also, Apple first said it was just regular maintenance. I'm just confused as to why they said that instead of telling us the truth.