Of course, I can't say for certain this is a reaction, but it seems to me like they're addressing the actual meat of the original article--third party apps can do whatever they want with your emails once they have the keys, like let their employees read through them. The issue was that the policies dictating how apps could use that access didn't seem to have much teeth; thus, the new security review.

Also, this announcement says it first came out in October 2018, while the WSJ article came out in July 2018?