Reply to post:

"Or just carried out responsible disclosure, where they tell Google first, then makes it public when Google had a chance to address it"

Could be, but I'd have expected them to be crowing about it as soon as Google pushed the update, especially once it had been pushed to Nexus devices. As it is, at least 3 months after release to ASOP, I'm not convinced.