So, the audit found (among other minor things) a pretty standard XSS vulnerability (on page 7) and lots of usages of `.innerHTML` which has been considered an insecure coding practice for eons.

While errors always happen and it is a good thing they found them during beta, I would definitely not say "the final report was overwhelmingly positive, and the audit uncovered no major issues or security vulnerabilities" (blog post).

Quite the opposite: XSS is the major attack vector of a web app for encrypted mail as it most probably enables access to plaintexts.

Am I misunderstanding the report here?

disclaimer: i work for a competitor and we discovered less severe attack vectors in the past but even then sent out notices to all users informing them about the timeframe of the vulnerability and such.