they got called out for hiding the reporting of it in tooling that can't be accessed by most security teams.

and they have some large contracts to which they are legally obligated to disclose it, maybe why they tried to hide it