MSFT has a documented way of dealing with the NSA and others; NSA can request bugs go unpatched for a time window (possibly indefinitely) and Microslop just leaves it until it’s a problem or the window expires.

Yellow key and XML are surprisingly blatant