With a gag order or they knew they were being watched digitally so they shut it down to protect the users would be a good way to not fuck over people and not get arrested for alerting users. The canary can likely be used as a way to arrest anyone that activates it or doesn't. If the fed hit the site the day after the last canary reset then they can spy for around a month or how long the reset time is between last and next. The thing is so many sites are secretly compromised that even anything that scans for that can miss it with the tech they have at this time. So they might get the code that resets the canary so passwords are useless when you get the nation level hack spyware. Likely even linux is vulnerable or the kernel has something already added that slipped through the people that check it or they allowed it for some cash when broke. Nothing is unhackable that is online.