If its enough of a security issue they could have pulled the site while its fixed/cleaned

If that was the case, you'd think it would've been a less dramatic outage right? Maybe even a status page to indicate that?

Because there are worse things than being down; if the front page got hacked and is spewing gore or CSAM or PII or creds, for example.