For those following along, note that Tavis disclosed the details several days after the initial fix in practice. The main discussion (and disagreement) was around how much time to allow for cleanup (removing the user data that was cached by search engines) vs user notification.
Since affected users might have needed to rotate secrets, timely notification was considered to be very important (and still would be under our new policy!). Some more details are here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 …