Being reactive to a breach is not the same as being proactive to prevent a breach.
I think part of the problem is the operative words in their blog while "engaging with their provider" they were informed about the server seizure. In other words, it seems that they may not own some of their servers, and contract with third parties for operation.
Imo, a weak link in a "security" operation may be when you contract with third parties who may not consider security and/or communication as seriously as you.
Whether Windscribe overcomes this "breach" to rebuild our trust is to be seen. Stay tuned!