In fairness, it's better that they rotate the key immediately before even looking at the logs. But we can demand better answers from them from this point.
> This week, we discovered...
So they found out about it sometime between Monday and Thursday, and rotated it Thursday evening.
Security issues are obviously very important, but equally I would be worried if they started acting impulsively immediately after discovering the issue, because there would not have been time to understand the problem and consider the options. If you jump on a solution without giving it a bit of thought first it's too easy to exacerbate the situation.