According to the Wall Street Journal, Google was apparently afraid of "regulatory scrutiny" and did not want to disclose the bug earlier this spring.
Google said it found the bug as part of an internal review called Project Strobe, an audit started earlier this year that examines access to user data from Google accounts by third-party software developers.
They will shut down Google+ over the next 10 months. Google has already been scheduled to meet again with Congress after elections in November.