it seems like they took reasonable steps after.

They acknowledged that it happened, fixed the bug that caused it, deleted all data that was uploaded.

I agree: the stated steps are what I’d expect.

I still don’t trust the company that made the decisions that led to that code being shipped in the first place.

Trustworthy companies take reasonable steps before.