> While that is true, it's worth pointing out that Google's Project Zero has a "disclose by default" approach to vulnerabilities they find

This wasn't a Project Zero bug, was it? Project Zero is a very special team with a distinct and notable charter. They aren't "Google's Security Folks". Certainly Project Zero has discovered and disclosed bugs in Google products in the past.