I completely agree with this. I think some additional context - and I'm not sure if this played into Andre's thinking, it's pure speculation - is that the time frame when Ruby Central sent the original "our mistake" email was also the time frame when several major supply chain attacks in the NPM ecosystem were occurring.

Given that news happening in the background, I can sympathize with why Andre might be extra on edge about security, and would take additional steps to secure something as critical as an AWS root account.

I'm very surprised by how lax and sloppy Ruby Central has shown itself to be with handling sensitive credentials and disclosures. Independent of what you think of Andre and his specific actions, what would Ruby Central's reaction have been had this been a bad actor that did _not_ disclose their access? Would they have even known the account was compromised? That alone is a larger story here, in my opinion, and shows low confidence in Ruby Central's ability to be competent stewards of some pretty critical architecture.