> The patches were merged

The approved methodology - described in the linked paper - was that when a patch with the introduced vulnerabilities is accepted by its reviewer, the patch submitter indicates that the patch introduces a vulnerability exists, and sends a no-vulnerability version. That's what the paper describes.

If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.