Well, what we do is generate everything, then share it privately and quickly amongst the core team for final review before flipping switches and making things public. One actually important part of this is verifying things like "the package I download from what will become the public release URL has checksums that match what's in the checksum file", so it does have to actually go up on our server for that.

And if we catch a minor packaging error at this point, it's easy enough to fix on the spot without having to do an entire new release.

Except in this case somebody got really eager, saw the release process starting, and posted a link to our downloads page (and I'm not entirely certain if it would have been possible to get the incorrect package from it), rather than waiting for and linking to the release announcement once we'd vetted and made everything public.