Note that it says "by the group that disclosed the issue". Xen's security process says that it's the people who disclose issues to xen-security that get to make

Note that it says "by the group that disclosed the issue". Xen's security process says that it's the people who disclose issues to xen-security that get to make this decision about pre-deployment.