As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected.

It's a pain to get hacked, but on the bright side it will probably help you harden security in the longer run. Some quick, simple tricks (e.g. use an .htaccess file to make a whitelist of IP addresses that can access your /wp-admin/ directory) can give a lot of protection.