By now I've seen at least 5 different people or companies blamed for leaks or releasing fixes early.

If anyone is at fault here, I'm looking at the PHP maintainers.

The embargo apparently held for like two months, during which they have not managed to release patches.

If you're seriously asking whether or not it's possible that someone was overconfident and thoughtless rather than malicious and calculating... yeah I find that very easy to believe. Process safety exists because as individuals and as groups we suck at this.