Presumably there's an assumption that they are "taking it seriously" and hardening their systems as a result. While it may not make them any less of a target (indeed, people now know they can be hit, and what NOT to try if they plugged this hole), they hopefully have taken steps to limit the legal, financial, brand and customer fallout.

If you think that is a valid assumption, perhaps this risk is not mitigated entirely, but it would certainly change the risk profile of such a black swan event, would it not?