I think their stated reason is very much to be expected: they are a financial institution, their whole business model (and therefore mentality) is to act quickly to decrease risk. Makes perfect sense that they would take it down first and judge later.

I'm not saying it was the right thing to do, but it's consistent with what I would expect, assuming the scenario is true (internal code, open-sourced without some higher-up knowing about it, higher-up hears about it, freaks out).