I don't understand why you're confident that those Github issues won't just end up coming later if literally everyone adds this cooldown

The security companies looking for and reporting the issues aren't going to use the cooldown too.