I'd call this an exception. An organization that is willing to take one on the chin, so to speak, by declaring a breach of their policies even in the absence of evidence of abuse of the policy violation is actively demonstrating their commitment to security before they've been hacked.

Does it follow that if an organization discloses a security issue, it wasn't serious about security?

Obligatory: http://www.troyhunt.com/2015/07/we-take-security-seriously-o...

Was just about to comment. Ever since I read the article, it's the first thing I notice (whether or not that's fair).

Great response from jedberg about the business costs of security and the fact that a company can take it seriously and still have a breach: https://news.ycombinator.com/item?id=9834461