For 1, in this case a much simpler script that verifies if newline can be added or not would have been sufficient. For 2, not releasing a PoC could be even bet

For 1, in this case a much simpler script that verifies if newline can be added or not would have been sufficient. For 2, not releasing a PoC could be even better. Someone else from the advisory might come-up with an even more clever angle. With the PoC released and it being so intricate, there is less motivation, so less surface area is explored in this case. For 3, yes it's always false sense, that's why the PoC release being delayed should not influence any appropriate reactions anyway.