The rule I use: speak publicly when silence would change what someone does with their money or their safety. Otherwise, put the effort inside.
I ran communications at bZx, a DeFi lending protocol, through exploit events. Those are the hard case, because the pressure to say something is enormous and so is the cost of saying something wrong. What held up was a three-part statement: what we know, what we don't know yet, and when we'll speak next. Every one of those is a sentence you can stand behind an hour later. What doesn't hold up is a statement written to relieve the pressure, because it usually contains a claim about cause or scope that the next hour's evidence contradicts, and then you're correcting yourself in public.
That experience gave me the boundary I still apply. Ask whether anyone outside the company would act differently based on what we say. A customer whose funds are at risk, a user who needs to change a setting, a partner who needs to pause an integration: yes, and you say it now, with the three parts above. A news cycle that would like a take from you: no. For that, the useful work is internal. Tell employees what the company's position is and what it isn't, name who they can send questions to, and make it clear nobody has to represent the company in their personal feeds.
The reason the rule reduces backlash is that it keeps statements rare and load-bearing. A company that only speaks when speaking changes an outcome is believed when it does. A company that issues a statement whenever there's pressure is graded on every one of them, and eventually one lands badly.
I'll concede the rule is easier to hold in a crisis than in a slow-burning cultural moment, where "nobody would act differently" is a judgment call and reasonable people inside the company will disagree about it. In those cases I'd still err toward the internal side, and say so plainly to the team rather than pretending the question wasn't asked.