Not sure why people flagged you for this. It's very common for open source projects to make the details of security-related bugs private. One example is Firefox, nearly every security update references one or more bug tickets that the public doesn't have permission to view.

I wonder if Apple listed the wrong webkit bug number, it almost looks like it.

Looks like the vulnerability was something to do with incorrect JIT optimisations on Maps and Sets, if the included tests are any indication.

The bug doesn't seem to describe the vulnerability at all, though?

When making security patches it’s often best to leave those details out, as otherwise it’s used as a guide for bad actors

The bad actors already exploit them.

The really good bad actors already exploit them. The eager bad actors with less skills look for guides.

How do you know every bad actor already knows how to exploit it?

The issue is made public when the OS patch is released. Binary diffs are a thing.