> Maybe they did and are well aware of all these attacks but to save face and performance hits they simply hold on to them hoping nobody makes them public?

Or they chose not to look for these types of bugs in the first place, for those reasons.