How would the government get in contact with the engineers who discovered the hack without going through their managers, the CISO, etc. ?

Not only would they have to force the engineers to tell nothing, they'd have to force all capable engineers to vehemently deny it to their bosses who ask or ask them to look again.