it looks like they are doing automatic renewal of certificates, the only ones that customers have to do themselves is the ones the customers uploaded themselves

Which reads like the CA key got compromised - the customer's keys are fine

Bunny is not a CA and doesn’t have those keys.

no it reads as if all individual private keys got compromised, hence requesting custom ssls to be updated