Does this mean that Google will be actively patching all the vulnerabilities they find? Then donating their work to the OSS project, they belong to? Or do th

Does this mean that Google will be actively patching all the vulnerabilities they find? Then donating their work to the OSS project, they belong to? Or do they deprecate / remove from registry packages that are found to be vulnerable? Or sticking to the last version they can find without the bug? All of those can in one way or another become a headache for people who use the service. Projects that depend on other projects and libraries and suddenly a library and suddenly they are not available? On the other hand these artifacts not being available for security reasons means customers owont deploy insecure products.