right, if you don't like the terms of the NDA, don't agree to it

that is precisely the choice made by the team in the article, because the NDA was bad, for the reasons you described

so it sounds like everyone is OK with this, the authoring team is just describing that issue, along with other issues, with the bug disclosure process (like lying about there being no vulnerability while simultaneously fixing it)