There's some new information released which mentions the github repo name, and since when the vulnerability has existed.
This security company's marketing blog is mixing up the facts with speculation. Let's especially be careful not to use it in the "nation state vs. kid in a basement" debate.
Especially the information that the repo was archived by Web Archive back in 2018. It's not easy to know the "who" but the how can be speculated and investigated.
I see where the researcher says it's not impossible he missed a certificate, but not a reason to believe he actually did. The article is unfortunately full of leading questions and reaching speculation.