I understand what you're saying, but in this case I doubt that hiding it was going to help much. The vulnerability would have been obvious to a lot people, and the site had already gone high profile via sites like HN so many people would have been aware of it.

In a position where no choice of action/inaction is guaranteed to be harmless, I think limiting the damage is probably the most practical choice, and certainly a reasonable one. It limits the number of potential victims, and it also serves as a warning to those developing future sites that this sort of screw-up is not acceptable.