I remember some of early Android phones that ran manufacturer maintained Kernel turning out immune to then-undisclosed RCEs years before disclosure.

I think it’s less about disclosure handling but more about being motivated to pay for or build a black magic code analysis tools.