But the security researchers did not have time to write a patch yet

This is not true. They never intended, and said would never try to make any modifications to the train software, because it would be very illegal, you can’t make modifications to the trains without the train having to go through recertification again and they have no credentials to be making any modifications to trains.

They only analysed a copy of the software, and found secret undocumented unlock codes that could just be typed in at the cabin without having to modify anything.