> If you're using e.g. RedHat, you are getting packages with embargoed fixes baked into them before those fixes hit public git repos.

The way you've written this is substantially misleading. RedHat receives notice of the vulnerabilities so they can prepare packages to be available the moment the embargo lifts, which I guess technically could hit the public packages a tiny bit earlier, but they are not releasing fixes of embargoed vulnerabilities to their commercial clients before the embargo lifts.

This is substantially different from the policy I've quoted that I am objecting to.