Once the fix is released, people will reverse-engineer it and use the exploit on pages that haven't updated yet.

So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.

The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed