The attack took place on January 14th, per the blog. The patch was released on January 29th, per this:

http://www.phplist.com/?lid=274

Based on that, they very well could have been up-to-date when they were hacked. As such, to chide them on it seems inappropriate.