The point is less visibility/criticism. Since this is confirming pretty bad news (the attackers had access to the environment variables.) The concept of a Friday night news dump is a fairly well-worn, but basically true, trope.

> With what intention? Honest question, I don't see a strategic advantage in posting this on a Friday. More of a disadvantage, actually, with less visibility.

The intention presumably is to be able to say they communicated this while (intentionally) limiting the amount of awareness that's spread about this.

With any hope it will slide in the news cycle and be buried by any developments over the weekend.