Because upstream is public. Once the patch hit the repos, people would know why and it’s now in the open.

I assume RH and others probably knew at the same time as Linux. I’d lay more blame with them on the lack of movement.