Very speculative: It probably gets labeled as a procedural error, i.e. the one(s) who report it to the log4j project thought it is already reported to the gove

Very speculative: It probably gets labeled as a procedural error, i.e. the one(s) who report it to the log4j project thought it is already reported to the government, and the ones on the other side say they thought the first team would report it to the government. Then they "fall-in-line" by implementing a security report system where you can't make the mistake, which automatically reports to the government and you need to get "clearance" to report to the project authors. Which, might have been what actually happened if I think about it.