StartSSL exploited their customers during a time of crisis (yes, servers leaking private information is a crisis) and they deserve the negative PR they are receiving from it.

Many people have even been proposing that StartSSL be removed from the trusted CA lists included with OSs and browsers since so many StartSSL certificates will remain unrevoked, and there is a valid point to that.