They are doing the right thing IMO, depending on how big the loss is(if there was any), maybe time can repair this situation, for both parties.

But the most important thing:

It's one case someone hacks their system and steals from their customers ; It's a whole different thing if they let other people make new deposit to repay the damage that was caused by the hacker.

So the people who have deposited AFTER they lost any coins must be prioritized.

I'm not a lawyer but this seems evident to me. I would also assume that if there was any theft, they'd have filed a lawsuit, because a hacker theft seems like any other theft to me.
Imagine having money in a bank, and then someone robs the bank. I don't think the bank is to blame for this, given that they had the right security measures.