Well they certainly can’t feel good about not detecting egress DDoS from their customer usage.

It could be VPN originating or maybe Worker originating maybe?

Don’t they have a security.txt and security@ email address?

Looks like posting to social media the full analysis of the attack is the sensible thing to do.