They did both. The leak was in numereous add-ons code, but they were able to change the semantics of the API to remove all these leaks. But that breaks things in some edge cases, but that was deemed acceptable (one time fix in some extensions, mainly those using Jetpack needing to embed the latest versions).