Even if you accept the rationale that the team behind the exploits were good guys going after bad guys, it's the job of Google's security teams to keep its prod

Even if you accept the rationale that the team behind the exploits were good guys going after bad guys, it's the job of Google's security teams to keep its products (Chrome and Android) secure. I think that they made the right call by disclosing the exploits after the security holes were fixed, but not outing the details of who the attackers were. The article seems to be suggesting that they should have left the holes unpatched, but that wouldn't work. Rival state-backed hacker teams do the same work that the Project Zero people do and would discover the attacks, reverse engineer them, and exploit them. It came out (either from Snowden or from other reporting) that the NSA had a term, NOBUS, short for "nobody but us". The idea was that if they had a hack that was so tricky that they thought that no one else could exploit it, they would exploit it, and if the hole they found was "easy" they would share it so it could be fixed. But that's just arrogant: nothing is NOBUS for long.