But without a similar audit on the alternatives proving their security, surely the most responsible action would be just to explain there is a problem and stop there.

But that's not what the audit found, and the guys who ran the audit are just as in the dark about this as we are, according to recent tweets.