It’s because one of the researchers works at Microsoft. I will assume they have contact who work at all the aformentioned companies, contact that allow the security report to escalate to the appropriate channels. I have reported the same security problems too in the past to several companies, and the majority of them have been closed as “informative/non-actionable” too.