Not necessarily - see the recent bogus curl CVE's for instance. There's a lot of incentives to invent or embellish vulnerabilities for street cred or other reasons.

Many years ago, a 'researcher' made claims to the media that our product had a zero-day that looked like a deliberate backdoor. They refused to tell us anything about the bug.