TFA doesn't hide or sensationalise that, makes the point that it's timely.
However many people will infer causation from the timing. Half of people don't even read the full headlines any more.
The EU Cyber Resilience Act, which is now in effect (but not fully enforced until 2027/2028), has additional details and also includes a reporting requirement (articles 14, 15, and 16).