That is completely irrelevant, the gross part is that (if true) they are demanding them to be fixed in a given time. Sounds like the epitome of entitlement to me, to say the least.

No one is demanding anything, the report itself is a 90 day grace period before being publicly published. If the issues are slop then what exactly is your complaint?

google literally tells them it's an ai generated report

That is not the definition of slop.

if it's unwanted then it is

and the ffmpeg maintainers say it's not wanted

so it's slop

It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions. It can be leveraged in an exploit chain to compromise a system.

I'm not a Google fan, but if the maintainers are unable to understand that, I welcome a fork.