These are relatively simple statistics. Some are even trivial. I don't see why it requires any people at all.

It wouldn't even have to be done by OpenAI. Given a list of vulnerabilities, it wouldn't be too hard for third parties to collect these statistics.