You are ignoring the problematic experiment's methodology, which explicitly prevents the problematic patches from making it in by drawing attention to the vulnerability after they are accepted.

Now, if this protocol were not followed, that's a different story, but we do not know this to be the case.

So is Greg K-H a liar when he said some were accepted into stable?

He didn't say vulnerabilities were accepted into stable, he said patches by these people were accepted.