AGPL is more "copyleft", but not really more "permissive", in the sense that AGPL adds the extra requirement of forcing anyone using the software in a server to provide the source to those people who use the service this server provides.

It plugs a loophole of the other GPL licenses that allows companies to not share any custom modifications as long as they don't directly share the binaries (they can offer a service using internally modified binaries, but as long as they don't distribute the binaries themselves they don't have to share the source code from those modifications, even if they are GPL).

However, I also don't think the change would really solve this particular bug reporting trouble. It's possible (likely even) that Google has not patched these vulnerabilities internally either, or at least the biggest chunk of them (since most of them are apparently edge cases that would most likely not apply to Google's services anyway).