Exim is an old codebase, but I've interacted with the devs often, this doesn't jive with my experience. Even filing a bug report or help request, they request the standard stuff to reproduce, config examples of the help request to give context, in a polite and professional manner. It's a lovely project, a flexible MTA and good stewards of open source. I don't suspect the communications will be released, but I have a bias to favor the Exim developers on this than a corporate entity offering bug bounties and clout.