The job of the witnesses is to sign blocks and to protect the blockchain.
After Sun's first tweet, it was clear what his intentions were.
He was going to ruin STEEM, out of ignorance, or because that was his 'plan'.
Further tweets and discussion revealed, that he is an idiot, who bought a product, which he does not understand. His 'plans' directly contradicted the core principles of this enterprise.
The forks were necessary to stop the attack.
Whoever helped Sun install his sock puppet witnesses, deserves to not be part of HIVE.
Furthermore, @ned should have been excluded from the airdrop, himself.
As for the timeframe, I would have preferred, if they had waited for the takeover to actually happen and then react by restarting the blockchain from an earlier timestamp. Technically, this must be possible, but would have been more complicated, I suppose. Morally, it would have been the cleaner path.
Moreover, as it was, smaller witnesses would have gotten hold of the HIVE repo too late to replay with the new version. Also, there is no way to do proper code review or any testing this quickly. I understand, why it happened, but it was an exclusive club calling the shots ... again.
I hope HIVE decentralizes more over time - For that, we are in a better spot than STEEM ever was.