I am not a Tutanota user but this is exactly the kind of response there should be to a vulnerability discovery. They immediately released a patch once they became aware, then disabled unpatched versions, and finally published all details of what happened including the critical detail of the timeline.
Good job Tutanota.
Everything will have vulnerabilities, nothing can be perfect. It is the response to those vulnerabilities being discovered that matter most.