So the end result is tens of thousands of sites that went BACK to 4.2.2 or did a Google search to find that replacing the one file affected with the old version that still has the security problem are still vulnerable. Hundreds of thousands of sites got borked and it took WordPress 8 hours to finally make an official post about the problem and warn people (too late) not to revert or use the old file. Which, in turn, caused thousands more to decide WordPress can't be trusted to auto-update their live sites (the livelyhood for many of them) and have disabled auto-updates for the future.

If, as they claim, they couldn't talk about it for fear of hackers finding out and exploiting it BEFORE the release, then there was certainly enough time to PROPERLY fix the issue that didn't require breaking the internet. Or, once the security release was approved and released to the wild, they could have posted about the problem right then and there to prevent hundreds or thousands of people from wasting hours on research to figure out why their sites were no longer working.

Overall, the WordPress folks have done a huge disservice to the community and their reputation by not handling this situation better. And I hope they've learned from it, but from everything I've read, they don't appear to even grasp the gravity of what happened because they don't live/work in the real world. It's the same problem with how new versions are handled, they don't understand how WordPress is used in the real world and they keep adding new features that make them happy, but not those of us who use it. The trust factor is diminishing and stupid stuff like this just make it worse.