Creating a new policy in response to a logically-inconsistent story of security risk after explicitly saying you wouldn't remove an account is optically worse than giving a gifted teen an internship.