Not made up -- Alibaba was actually punished for reporting log4j vulnerability:

https://www.zdnet.com/article/log4j-chinese-regulators-suspe...