I think the point being made here is why are both numbers not disclosed, and only one was? I think both the time the bug existed and the relevant timeframe of

I think the point being made here is why are both numbers not disclosed, and only one was? I think both the time the bug existed and the relevant timeframe of known exploits should be part of a responsible security disclosure. Omitting either one is a disservice to users.