First of all, thank you for carefully making your point and not conflating your criticism on the communication with questioning the seriousness of the technical issue.
I personally also found the level of marketing noise on some of the websites distasteful for an extremely serious vulnerability of this caliber. I agree that probably didn't help with credibility for readers without any security knowledge.
That being said, the writeups and demos published on these sites made it very clear to anyone with basic knowledge about how things like UAFs get exploited (and I mean basic, I couldn't write a working exploit for something like this myself!) that this is a very serious issue. The presented facts lined up with the claimed impact, unlike the many hallucinated slop repos that appeared before the public disclosure. My issue is that for some reason non-security people often don't believe the security people in cases like these, and I don't quite understand why that is such a consistent issue. And besides, as you already mentioned, it wasn't just OpenAI, Wiz, Calif saying that this was bad, the PHP people said the same. They certainly had no interest in blowing this out of proportion.
I also personally think the concerns about 15 minute exploits were genuine and warranted. Maybe the chance for that wasn't overwhelming, but I believe it was there. The bigger issue, however, comes from the ability of adapting an exploit to other builds once one exists. Another comment on this post asserts this vulnerability "will never be a one-size-fits-all-PWN-button". And historically this has been somewhat true for binary exploitation (depending on your threat model). But the problem is, even if public LLMs can't quite consistently one-shot a full pwn exploit in 15 minutes, they absolutely can very easily adapt an existing exploit to other target versions and builds.