You are ignoring the problematic experiment's methodology, which explicitly prevents the problematic patches from making it in by drawing attention to the vulnerability after they are accepted.

Now, if this protocol were not followed, that's a different story, but we do not know this to be the case.