If you want an orderly fast global rollout you need to have the maintenance team and distributors working together.

Because...that's what the PHP security team does?

No one needs to use their work, or indeed PHP at all.

But that's why the PHP security team exists.

So if Wiz produced their own patch to PHP, and Calif produced their own (slightly different) patch, and OpenAI produced their own, which version should I use, as a user of PHP? Should I manually merge them? Is Calif's better than Wiz's? Is OpenAI's better than Calif's? Are they complementary?

So anybody can just push out a new release of PHP?

What's the other choice? OpenAI et al could have developed a patch (for all we know they did) but you need the PHP team's participation to get it out. The alternative would be to fork the project and put up a forked release with the fix, which would have been incredibly disruptive.

What would you have a security team for then?