So if Wiz produced their own patch to PHP, and Calif produced their own (slightly different) patch, and OpenAI produced their own, which version should I use, as a user of PHP? Should I manually merge them? Is Calif's better than Wiz's? Is OpenAI's better than Calif's? Are they complementary?

That does happen with downversion software. Red Hat may distribute a backported patch to some component which isn't the same as Canonical or Debian's.

Most users, who don't know the answer to your questions, rely on the distro to figure this out (and often pay good money for it).

They already were in communication with each other. They could have come together and decided on one that mitigates the issues they've found.