I feel like lots of organisations did not want to believe this, because it would've meant they need to pick a different provider to be legally compliant. If a larger actor talks about it, they will have a harder time arguing in court that they thought they were doing everything correct, which is likely to result in higher fines.