I had to do a double-take when I read the "7 days" part, because I wasn't sure why that should be a pleasant surprise.

If it were their desktop client, that kind of turnaround would be understandable. For their website? I don't see why they couldn't have deployed a hotfix immediately.

On the other hand, perhaps they had a quota of more serious security issues and were preoccupied with addressing those.