It doesn't feel like splitting hairs to separate this from things like 'we found an obscure xss exploit internally which is now fixed'. It is explicitly a Possible Breach, not just a Bug. If you're arguing that Possible Breaches don't require disclosure, well, that's a choice to make, but it worked out poorly in this case and it will probably keep working out poorly because everything G does is under a microscope until the far right gets bored with them.
There are about 430 developers that could have exploited this vulnerability. There was no evidence in the available two weeks of logs of it being exploited. And the number of users and types of data available make Google+ a low value target. The decision to not announce was reasonable, common, legal, and moral.
It sets a poor standard to suggest they should have acted different because they’re now under fire from people with far darker motives than reporting truth or advocating for consumer privacy. Those exploiting the story for their own gain should be shamed rather than capitulated to.