The target for the communication is investors. I read it to say "Price in the costs for a garden variety data breach, but not a CPRA-specific class action."
Bingo. The average T-Mobile user doesn't really understand what a breach is, and the handful of network engineer / tech nerds here on HN getting angry about it is superfluous to their bottom line. They're talking to investors, and maybe ISP Peers.