He is right to blame the org and “paint them with the same brush” as errant employee if they do not own up to their mistakes; especially if it concerns something that is part of their main product. Can you imagine some tech company having a data breach because an employee was careless and NOT admitting to the breach? People lose their jobs for that kind of mistakes, not get a pat on back.