Also; all the press articles I’ve seen on this have taken the word of the vulnerability finder as gospel - they haven’t actually fact checked it.
Eg none of the CVEs are CVSS score 9.9. Or close.
The sole source in articles shouldn’t be a known bully. The story is probably more how this played out so it doesn’t happen again.