They're not. They're heavily dependent on Google, especially CVEs.
Who do you think runs the AOSP project or Project Zero?
What do you mean more precisely? :)
Who do you think runs the AOSP project or Project Zero?
What do you mean more precisely? :)