This is published on a marketing website.

If it were not a marketing scheme, they would responsibly disclose the vulnerabilities to the code owners, and go on with their lives.