It’s not clear what observation you are referring to here.
As far as BT keeping quiet goes, I would assume it has more to do with security. They have so many units to update that I doubt they can’t do them all at once, as it would create too much traffic. I get the impression that they roll the update out by region or serial number. Either way, it takes a while to up date them all and in the meantime, if they published the vulnerabilities that had been fixed, the bad guys would have a field-day with the ones still to be done.
If it is the DoS spoofing and scanning you are referring to, I have an interesting observation. I have two SH2s. One suddenly switched to doing a CWMP session once per hour, instead of once per day. DoS spoofing etc. dropped to practically nothing. The other one does a CWMP once a day and the DoS spoofing is just a before.
