I was wondering this too. If the researcher was playing by the same rules that Google does with vulnerability disclosure, the post would have gone up months ago regardless of whether Google had fixed it yet or not.