This "advice" is even written on the report itself:

  The attack was loud; removing all developers caused everyone to get emailed.
  Given the credential taken, its likely a quieter attack would have provided a
  longer opportunity window.