> 4. They intervene at this point and reveal that the patches are malicious

> 5. The patches are then not merged

It's not clear to me that they revealed anything, just that they did fix the problems:

> In their paper, Lu and Wu claimed that none of their bugs had actually made it to the Linux kernel — in all of their test cases, they’d eventually pulled their bad patches and provided real ones. Kroah-Hartman, of the Linux Foundation, contests this — he told The Verge that one patch from the study did make it into repositories, though he notes it didn’t end up causing any harm.

(I'm only working from this article, though, so feel free to correct me)