Who originally developed the codec is only half the story. In 2011, 17 companies created a CCL agreement around VP8+WebM. In 2013 Google signed the sub-licensing agreement to keep it free. Any of the legal teams at those 17 companies had the chance to catch it before then. That there were a lot of legal team reviews by the big tech companies involved did not catch everything. The system isn't designed in a way to make that a solid guarantee like it should be.