It sounds like these issues are from before the fork, in which case they will be

It also doesn't sound like the researchers made an effort to safely disclose these findings to the OpenBao project before publishing them, which I think would have been the right thing to do