It certainly doesn't look like they've publicly released anything. My guess is they found a problem and have been following reasonable responsible disclosure guidelines. However, the 90 days (or whatever time limit was given) is likely expiring and to head off publication, flux.ai is getting lawyers involved.

This is all 100% speculation, just based on checking the archive sites and search sites historical data and finding nothing.

what about if I knock on the door (send an http request), and someone comes to it and hands me a bunch of documents (sends an http response with data).

It often does when your front door is otherwise a business storefront. Without knowing the specifics of what was accessed, analogies really aren't helpful. And there seems to be zero context here, so this strikes me as the most plausible scenario: https://news.ycombinator.com/item?id=48368635

(I agree that Adafruit's statement itself is worded pretty terribly!)

That isn’t legal in most jurisdictions either. You’re not a lawyer.