This is not "coordinated vulnerability disclosure". It's waiting for slow vendors at the risk of everybody else.