They report to CSO ? Would be pretty unusual again not a googler but normally that would not be part of security team

Google has a lot of security teams since they do all of their infra themselves. The people who push security patches to peoples OS's is a security team, and they used that channel to push a message similar to this.