They're pointing out that if the transgression were more severe, we'd easily see right through the hole in the reasoning.
What they did was to silence a security researcher, produce marketing material with falsehoods, and as a result ultimately damage their customers by allowing a security vulnerability to remain present, and not raise alarms afterwards that customers need to ensure that they were not exploited. They actively decided that harming their customers was okay if it allowed them to avoid attention.
This is not an accident, but an intentionally committed crime. No lenience is warranted.
I agree that, crime or not, it was intentionally committed, and does not warrant lenience, though.
They didn't accidentally spin this so hard into a cover-up. Sure, if they showed a repeated pattern of such behavior, they should see greater consequences, but they still deserve to get called out hard on their first cover-up.
