BS. Being a CVE numbering authority (of which there are several hundred) does not grant a veto against CVE issuance. They are allowed to issue CVEs on their products but by no means are they the only authority that may issue them for Apple vulnerabilities.

Also, you don't need to issue a CVE to publish a vulnerability. You just make it public regardless and say CVE was denied for it.