You’re missing the point. They are blocking the security patches themselves. “Google has a policy to…” is invalid when a nation state, especially not one with one of the strongest intelligence gathering apparatus in the world, has a law telling them what to do.
Google already works with the intelligence agencies. It would be naive to assume otherwise
A completely random person anonymously putting the information out online is not the person releasing the security patch. That’s probably why they are focusing of the updates themselves. Easier to hold someone responsible
Can’t say that anyone saw this coming