Is this a fair comparison? Why would we know about a cloud provider finding a vulnerability in their own product? Wouldn’t that be kept internal?

Vulnerabilities are typically fixed, and then reported.