> claims they have an "universal" exploit

That's not correct. He claims they have A exploit. Based on the nature of the vuln, I assume every one that works in the are would be very careful to claim a universal exploit, and the comment by Mr. Guido seems to be align with that.

> This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

So what he seems to be saying (My interpretation) is "I don't want to demonstrate thus risking giving ideas to other people regarding hhow to build exploits"

The steal my bitcoin exploit works for a specific stak, and that is the reason why the person that set that up did publish certain information in the site itself (reduced phpinfo)