Maybe, but if I was maintaining PHP or another critical software, I’d think twice about letting Chainguard have inside information.

I would let Chainguard deal with the patches post official release like all other unreliable parties.