It doesn't matter if they show "responsibly disclosed" all their repos are publicly available to see, it takes one person looking through commits then going wtf is this followed by a quick look at the code and a blog post to make this a wildfire.
Considering the circumstances, it appears that the process that was followed with regards to the release was as flawless as it could have been.
Other than that, yes, that's exactly the notion.