They make it sound like patching will alleviate the problem but patching is not a solution for a lot of use cases (where it is unfeasible to redo the encryption or when the NSA already has the ciphertext).

(not that "slightly less secure than we had hoped" is enough reason to panic.)