depends how embedded the issue is. If the fix for it is going to break or expose other things, it could be that more time is needed. I don't mind that 90 days

depends how embedded the issue is. If the fix for it is going to break or expose other things, it could be that more time is needed. I don't mind that 90 days is a soft deadline, at which point as long as they're showing determinable progress on the issue, all is well until it is patched. But disclosing the bug before a fix is in place exposes users to possible actors that wouldn't know of said issue previously (ie like WannaCry being based on leaked NSA offensive tools. Leaking effectively being an involuntary disclosure).