Also, let's maybe not call the result impressive until we see what's under the hood.
These are relatively simple statistics. Some are even trivial. I don't see why it requires any people at all.
It wouldn't even have to be done by OpenAI. Given a list of vulnerabilities, it wouldn't be too hard for third parties to collect these statistics.