Notifying vendors first about security flaws is a cybersecurity industry norm, but a new law encourages Chinese companies to first notify the government

That’s a bit… worrying

I think this is a wrong gesture on China’s part. The government should be a secondary entity to the developer entity of software code affected. Apache software’s bug should be known to Apache first, and then anyone else, considering Apache server is used everywhere in the world.