i'm pretty sure this is not true:
The most recent example i remember is:
https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbh...
Note that I wrote and included a suggested diff for OpenBSD already, and that
at the time the tentative disclosure deadline was around the end of August. As
a compromise, I allowed them to silently patch the vulnerability.
(https://www.krackattacks.com/#openbsd)