If it were not a marketing scheme, they would responsibly disclose the vulnerabilities to the code owners, and go on with their lives.