I think these are 'better safe than sorry' cases, and that as more data rolls in they will re-calibrate. Look at it in an adversarial way: whoever wants to spy on the US could easily try to make the gear small enough that it would be taken for something innocent, and then to use a satellite uplink to move the payload off to the mothership. The question isn't really whether or not this particular balloon was a mistake or not. The question is what the minimum size is of a balloon that is still a viable spying platform. I don't have the answer to that question, but I've seen some pretty impressive miniaturized gear that I think you could easily take up with a small balloon, enough to be worried about it from a counter espionage point of view.