I think the main issue in this incident was how long it took 'the railway' to realise that it did actually have a significant incident happening, and that the emergency procedures necessary to deal with it needed to be initiated (which perhaps are initially getting MOM(s), etc. on site, and activating the gold/silver/bronze incident managers).
Perhaps because initially nothing much had happened: one train was just moving very slowly (it never failed, or was declared such), everything else was just held by red signals behind it.
Until passengers started self evacuating on to the track. When the railway had essentially lost control, and did have have a major incident.
As has been said multiple times, when a train is stopped away from a platform, passengers will, sooner or later, self detrain. And here they seem to have had half an hours start, in thinking about doing so, on the railway, thinking that it needed to do something so they didn't.
So perhaps the primary lesson to be learnt is that when - as soon as - a train stops away from a platform, the railway has a potentially serious incident to deal with. And within a few minutes then the escalation procedures to do so should be launched. Especially in a vulnerable or critical area such as Lewisham, and the SE mainline out of London Bridge.