It's the same point the current highest comment made:

Even though the system was compromised, they assumed the best case instead of the worst case as would be expected with customer data.

The money seems to be a proof that their impact will be larger than just a person who stays at a hotel twice a year.

I don't think that's how to read it. They probably did not assume that at all. But they are not going to go public with any information until they have confirmation.

You're reading a postmortem and not necessary exactly what they were thinking at the time.