I’d say it’s likely they were instructed to sit on it until the time is right
* CIA malware is discovered by a (Russian) Security company and they release a report about it.
* CIA malware discovered a year or more ago by a (Russian) security company and they tell the CIA about it and the CIA asks them to wait 1y+ to release the report, and they obliged.
I think Occam's razor is often misapplied in this way. It's for explaining natural phenomena, not for surmising the intent of an intelligent entity with an incentive to deceive.