That incident response firm seems to be worth it.

Weebly is one of the more clueful startups. They didn't get this from the IR team. They've been doing stuff right for a long time.

I don't doubt that they're clueful. That's why I'm confident that they hired an excellent incident response team and wisely chose to have them review and edit any external communication. Anything less would be irresponsible.

Weebly's team made the conscious decision to use security protections like bcrypt hashing on passwords, and they've been doing that for a long time (years). They're well aware of security best practices, and that did not come out of work with an incident response team for discovery.