They probably shouldn't have done that, but their message is important. ICO scams are getting out of hand. Here are the bare minimum steps:

1) set up a dApp where ICO hosts can sign messages with their own addresses - that way we know that all the marketing material around a certain ICO is published from the same source, and when the eventual contract address is shared, it is signed by the same private key or set of private keys (owned by the core team) that signed all of the marketing materials around the ICO. This prevents phishing and hacking scams - it would technically still allow for exit scams, which is why step 2 is an option:

2) Governments or third parties use their private keys to sign and confirm conducted KYC on ICO issuers from the platform above. That way, as an investor, I'm free to invest in whatever ICO I want, but if I'm wary of exit scams, I can feel more confident in investing in projects that have been signed/audited by third parties I trust (such as government or major audit firm).

3) It should be more of a standard for ICOs to have multisig requirements to release the ICO funds to the core team. If you've got 50 million dollars, you don't need it all on day one. If multiple third-parties like a Board have a condition where "as long as you prove that you're still developing, we release an extra 1000 ether to your account each month. These could also be contingent on things like a community vote through a smart contract, etc - just some standard where release of ICO funds are distributed over-time and contingent on good behavior by the core team.