“Google applied a standard 90-day industry deadline for fixing AI-discovered vulnerabilities in FFmpeg, which was misaligned with the project's volunteer-driven nature.”