If they'd just said "We securely store your passwords", they would have tech people with pitchforks and torches about how they need to name their password hashing algorithm.

If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold.

As a company reporting an issue, no matter what you do, the internet's gonna nit pick