If I was a lawyer, the basic requirement I'd have for a statement like this is to make it so it can't be construed as an admission of guilt, because that may later be used in court to extract damages.
You probably should blame legal, not PR.
You probably should blame legal, not PR.
In fact, they seem to agree. I loaded the page just now, and "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." is no longer present in their statement.
Their statement is still unbelievably condescending and awful (and none of that has any legal bearing that I can see) but they at least removed the part where they outright denied any security problem.