If the truth makes them owe damages… then they rightfully owe the damages, which would make that silence willfully unethical. It’s wrong to try to avoid making things right especially if you think you have a legal obligation to make things right.
So sure, just do your absolute best to shirk your legal obligations. Most companies do. But most companies didn’t have Stripes’s reputation.
That said, I personally don’t think this is what Stripe is doing. I think they STILL aren’t 100% sure what the whole situation is and they don’t have anyone close to this who is willing and knowledgeable enough to call the shots any more quickly.
So it looks like a long investigation in parallel with the fix, and maybe some external feedback (this letter, some minor legal discussions with affected parties), will help provide the learnings and context necessary to actually understand what the effects were and what their responsibilities are.
They may not be able to make it right immediately even if they want to because they’re not quite sure what (precisely) they legally screwed up and how that affects each customer.
So, there’s a fine line between malice and local incompetency (which doesn’t even have to be massive incompetency! Someone who has 95% of all the experience they need for the role could get caught off guard in this situation). I’m sure stripe has the expertise it needs for this, it just might not have been in this group at the time.
Of course Stripe isn’t blameless as a company, they’re a huge financial company with more than enough resources to prevent, mitigate, and recompensate these kinds of accidents.
It’s understandable that things can fall through the cracks in such an ambitious tax engine.