There's a good chance that if it's not a previously known vector, they've contact the author of the component with some opportunity to fix it before it's public

There's a good chance that if it's not a previously known vector, they've contact the author of the component with some opportunity to fix it before it's publicized and resulting in attacks from new parties.* * I neither agree nor disagree with zero-day disclosure policies. I'm just noting the possibility that they could be aware of the vector and would rather not share that information yet, for various reasons.