Well, if it wasn't a zero day, then it means they aren't patching their own services in a timely fashion. It's also possible that they have to word things care

Well, if it wasn't a zero day, then it means they aren't patching their own services in a timely fashion. It's also possible that they have to word things carefully because international diplomacy happens in a language that looks like english, but is not. (In the same way the legal documents are not quite english.) For instance, "China exploited zero days in our cloud services and targeted US gov't communications. We are addressing the situation." could mean "China has committed an act of war against the US, and we are responding in kind on behalf of the US government." The last time I checked, Microsoft did all sorts of shady clandestine stuff for the US military and intelligence communities (they even supported the US CLOUD Act). Also, they manufacture stuff in China. I'm sure they have to be very careful with this sort of press release.