It's a University, so the turnover of most involved would be fairly short (years), and although some bad commits (<10%, not sure how you define as too many, that could be 1), most were found to be good. This was not a case of a repeated offender (although several commits by one group in the University), so probation is in order, but a ban would make little sense as individuals could still submit from personal accounts where there is even less accountability then where the University is hopefully dealing with the issue internally.
I think it depends on who knew about it at the university when it was going on.
If it was just the two graduate students with a boneheaded research project and the assistant professor approved it. Why should the university, especially that university system as a whole, be punished?
If it was known about and condoned or approved by the department head. Then maybe the whole university. If it was known about and condoned by the dean. Then definitely.
If two Google employees did this for research and an assistant manager approved. Without anyone higher up knowing. Should all commits from Google be removed?