It documents that there was active attack four days prior to the embargo with suspected leak happening prior to Pete’s post here on HN, which was a day before the embargo ended that Pete was unaware of when posting.
The vulnerability could have been independently discovered. Organizations involved have said that's not unlikely
There is a liability in the USA if their organization was the one leaking, so plausible denial is the legally safe route to take for a company governed by USA regulations.
"it remains unclear how the actor acquired exploit information prior to disclosure."