It's easy to criticize from the sidelines, and I don't have the inside picture, so take anything I say below with a grain of salt:

1. I somewhat understand the embargo. It's literally Google's "proven" strategy on Android. But were you as a user of CLN realizing you were using foss-as-in-Android-not-as-in-Linux?
2. Any h4x0r with a bot is now statically analyzing CLN. So the embargo is pointless. This is basically the increasingly common sound you hear from groups like kernel-security "why are we even bothering with embargoes if the best thing we can do for a defender having a level playing field is being upfront about bugs?" i.e. we will likely move away from embargoes and into read-the-maillist-or-get-rekt. The thing that does need to change for this is bundling features with security-critical bugfix releases, and "we don't support previous versions" is the devil now. Backports are life-savers.
3. Red team is doing some good things and bad things. Like all humans? It's good that someone is looking. I do think they have insufficient experience, on both ends of the security research process, to do this properly, based on the endless bragging and comms fuckups. But on the other hand, we may get a lot of pain at once. Cut out the cancers. Which is... 99% of the "ecosystem", especially those that grew fat on Jack / HRF monies. Good riddance.
4. I think the real thing for @Scoresby & co to be happy about is that SN is delivering some value here and that people are bitching about that. GREAT! Let's make them bitch more often.