No, they're not - they can just release and wait for another vulnerability disclosure. Then the loop between [Vendors] and Project Zero needs no humans in it.