That’s quite a weak confidence in their own platform security if finding a root level vulnerability is not one-off event, but it’s a program expected to have multiple people routinely finding those.

Well it's a selection bias.

If an athlete breaks a world record, they're likely to do it again. Even though it's incredibly hard to break a world record.