They've probably rotated the keys since they were notified of the security breach.

But yes, companies that act this way undermine the resolve to disclose their security vulnerabilities.