That's one way of viewing it i guess. My guess would have been that an organization like Mozilla has to make sure what the consequences are for not complying, and after they figured out there was no real danger they did the right thing.
It's easy to say they should always do the right thing, but they have to keep in mind their own safety, and that of their project too, it's not an easy thing to balance.