Same code, same comments, four operators, one week. The fix was public in the source tree for a month before it reached the browser.
Self-hosting transfers the patch obligation. In a window measured in days, that transfer decides the outcome.