Huh, I have a tiny machine at one of those smaller places, and they are on the list. Good to know the smaller players can build up a reputation for embargoing, too.
They spell out the requirements for getting on the list - one of the valid ways to qualify is basically just being a webhost that uses Xen.
Interesting that over half of the companies on the list were added within the last week, if the dates in the page changelog accurately reflect when they were added. If so, perhaps they all suddenly bundled in so they could find out what the embargoed vuln. was.