Actually they did close the web services quite early. It is likely they are not the only ones with a similar problem, only they did notice the bug was being exploited and did act and communicate on it.

And you don't really expect them to blindly patch things right away do you?