Too early. The shit storm is less than a day old. You wouldn't accept an insincere apology right? So we shouldn't demand an apology before a sincere one could possibly be issued.

They don't have to, it's the ,,redearcher'' who has to apologize.

The University has to do exactly what they have done and follow up, to keep their reputation.

They have to investigate and also apologize accordingly in the name of the university.

Saying the researcher is the only responsible of a work that is managed by the university (with things such as probably funds and for sure resources) is just wrong.