If they quietly brushed this under the rug - especially given the PyPI malware that was involved - it would be a huge scandal.

Disclosure is the only ethical response to this.

The target audience of this blog post does not give a damn about PyPI. The affected parties get literally nothing from this post. They already disclosed behind the scenes, that was the ethical part.

Writing PR pieces competing to be the most dangerous model around (so give us money!) is the unethical part.

Then disclose to real organizations. Not twitter