Hi Dan,
I think that there are a couple of lines of thought here. I think that we should make a distinction between individuals and the institution of WMF.
For the former, I think that you make a good point. Along the same lines, there were probably people who worked at WMF at the time and had no involvement in the decisions regarding Superprotect, or may have done internal advocacy against it.
For the latter, the institution of WMF remains, and so does the loosely defined organization which I call "the community". WMF's actions in 2019 with regards to English Wikipedia's governance had some disturbing parallels with Superprotect.
An issue to which I've been giving increasing thought recently is the distinction between an individual WMF employee/contractor and WMF as an institution. I especially try to be mindful of this distinction when employees communicate in public and say that they are communicating individually, that is, not in a WMF role. They take some personal risk in doing this, and I usually think that their comments which are made in their personal capacities are constructive and made in good faith. The same goes for WMF employees who volunteer for projects such as Commons photo campaigns or in the strategy process outside of their work hours. Where the situation becomes more complex is when WMF employees are participating in what appear to be their normal staff roles. Sometimes a decision that is made by one person in the organization in their staff role will not be a decision that other people in the organization would have made in the same way, but when someone uses a staff account then I generally attribute their actions to their employer.