Why is there an onus on Google to fix this? Bug bounty hunters aren’t required to submit a patch even when the target is open source.

Now should Google? Probably, it would be nice but no one has to. The gift from Google is the discovery of the bug.