It doesn't mention this in the article, but I assume they got paid by Trend Micro for their work? Bug bounties, etc. If so, I wonder how much they made?
https://news.ycombinator.com/item?id=10882563
https://bugs.chromium.org/p/project-zero/issues/detail?id=69...
The whole thread of comments is quite scary...