I had the same question- "Does taking down the website cure the violation?"
Here's the relevant clause in GPLv3:
> You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
> However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
> Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
Basically- the website WAS in violation, and Mastodon is within their rights to permanently withdraw the license following their 30-day notice. I think the key here is the difference between "cease violation", with truth.social has done by taking down the site, and "cure the violation", which refers to correcting the earlier violation by distributing the source as it existed at that time. Without "curing" the previous violation, then truth.social cannot launch again with any modified version of Mastodon, as their license will be permanently revoked.
That said, there's leeway involved due to truth.social not being intentionally public. On one hand, "people were able to access it and make accounts", on the other hand, gaining access to some company's internal GPL tool because they misconfigured a VPN does not entitle you to source for that tool (and you violated the CFAA). It's a question for the courts, but it probably doesn't really matter because one of three things will happen:
1) truth.social will re-launch with no Mastodon code, and doesn't care if their Mastodon license is revoked.
2) truth.social will re-launch with Mastodon code, will provide their sources, and the whole thing goes away.
3) truth.social will re-launch with Mastodon code, will NOT provide the sources, and Mastodon has a much stronger legal leg to stand on.