It took them 6 months to fix this properly?

They patched the vulnerability within 2 days. They spent 6 months rearchitecting their backend. It's a major service for themselves and tens of thousands of customers, you don't vibe code yourself a new database query execution engine overnight.

It's Microsoft, of course. Their org chart basically dictates it.