This comes to mind as an example of how things might have gone differently for Boeing if they'd handled this better: https://www.ou.edu/deptcomm/dodjcc/groups/02C2/Johnson%20&%2...
Sure, its a nice sum of money, but I think most CEOs still prefer not having the money and the scandal not happening. That is not to say that current repercussions are enough, just that it is currently not net beneficial to have a scandal. Notably, with the current low levels of repercussions, it might still be net beneficial to risk a scandal though.
EDIT: To elaborate, getting ahead of an unfolding story is difficult even for experienced PR people. One misplaced word may be taken out of context or even used as admission of guilt in an ongoing investigation. This is generally why PR folks default to true generalities, e.g. "we care about our customers' safety" or "what happened is terrible and should be prevented from happening again".
My knowledge of PR is limited to the book "When the Headline Is You" which I highly recommend. It gives a great perspective on how companies manage themselves in the public light.
When it comes to disclosing hacks, standard practice is to disclose a small hack first then disclose that the hack was "worse than previously thought".
Examples:
https://www.slashgear.com/outlook-com-hacks-is-worse-than-mi...
https://news.vice.com/en_us/article/a3pqqb/the-facebook-hack...
https://www.scmp.com/news/hong-kong/law-and-crime/article/21...
https://www.theregister.co.uk/2018/02/13/equifax_security_br...
https://www.trustedreviews.com/news/ba-hack-investigation-36...
Why is this such a common way to handle these situations?