Shouldn’t they be keeping bypass strategies a secret right now?

They're up against a company with more money and developers than they know what to do with. This is, at most, a game of cat and mouse. Secrecy will buy them a sprint or so.

If Google wants to go nuclear, they can do some rolling encryption bullshit or put a million calls all over the OS to check app validity and stop open source altogether.