The source was shared in June 2015. It could have been later though, Allwinner tends to rewrite their Git history.

Thomas Kaiser appears to have been the first person to discover it on April 29th, 2016. http://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390 (Thanks to HD Moore for linking me.)

From what I can tell, it went unnoticed for slightly under a year.

I haven't looked into it, by my assumption has always been that they've kept certain modules and interfaces as closed-source, but that big chunks of the kernel were open (or that the kernel was closed for some of their SoCs and at least partially open for others, or some similar combination).

I may be wrong on those points. Maybe someone can correct me.