They probably patched their public-facing web servers, but not their internal link-fetching app servers.

Their public-facing servers (that receive requests) were patched but not the code that made outbound HTTP requests.