It seems like a lie because they tried to hide this incident by deflecting to a PR fluff post first [1]

They only published a proper [2] disclosure post later once their hand was forced after the researcher's post hit the HN front page.

[1]: https://news.ycombinator.com/item?id=44954242

[2]: I use that term loosely as it seems to be AI written slop.

100%. Sounds like a very common oversight at many companies.