The researchers in this case literally checked the patch after release. It costs nothing to send them a pre-release and ask the question

That’s different. I’m not here to mark your work but if you publish your work, I’m happy to publicly point out that you’re wrong, especially if you’re Microsoft size and should have work checkers internally and are continually doing the wrong think and putting people at risk as a result.