It's a bit hyperbolic, but historically Valve have been very strict about VAC bans. If your account is hacked and someone cheats, they can get it permanently VAC banned and Valve will not negotiate or be lenient about it -- ever. I know this from experience and it's well known. In this case Valve will probably remove the VAC bans because it's such a high profile mistake on their part, but you can see why people are concerned -- especially when they haven't said anything publicly yet.

This exploit was mostly used to hit Twitch streamers. People whose job involves using their Steam account. They had hours of reduced revenue due to this attack and I find it unlikely that Valve will even acknowledge any opportunity costs, let alone reimburse them.