"We have fixed it" is easy to understand as "you're now free to blog about this flaw"; one could imagine why Spotify would want to take the time to properly audit the rest of the site.
Also, Spotify is a serious business that doesn't want to go down, and likely has a testing/deployment process a bit more complicated than "just push to master".
Also, Spotify is a serious business that doesn't want to go down, and likely has a testing/deployment process a bit more complicated than "just push to master".