What's more likely:

* CIA malware is discovered by a (Russian) Security company and they release a report about it.

* CIA malware discovered a year or more ago by a (Russian) security company and they tell the CIA about it and the CIA asks them to wait 1y+ to release the report, and they obliged.

I think they're suggesting that a Russian security service (FSB?) might have asked Kaspersky to sit on it until the time was right. I don't think they were referring to the CIA, since yeah, that wouldn't make much sense.

Did you take occam’s razor into account? Why is this likely?

Occam's razor hardly ever applies to stuff like this (news in the intelligence space) because deception is the whole game. A tendency to believe simpler explanations is something they exploit.

I think Occam's razor is often misapplied in this way. It's for explaining natural phenomena, not for surmising the intent of an intelligent entity with an incentive to deceive.

People putting their eyes out with Hanlon and Occam's razor always makes me sad.

The timing is very sus given recent and ongoing spy mania in eastern europe (if you’ve been following)

The thing in EastEurope is not intelligence-based, its' political.

There’s a difference?

The difference is that there is no new informational knowledge coming out from the East Europe affair. It's just matching expulsion numbers, but none of the parties (or the general public) learned anything new (as with this disclosure).