I wouldn't put it past them to have a second unpublished paper, for the "we didn't get caught" timeline. It would give the University some notoriety to be able

I wouldn't put it past them to have a second unpublished paper, for the "we didn't get caught" timeline. It would give the University some notoriety to be able to claim "We introduced vulnerabilities in Linux". It would put them in good terms with possible propietary software sponsors, and the military.