If there is evidence that a vulnerability is actively being used by an adversary, sure, it’s more responsible to disclose sooner, but in general you want to tak

If there is evidence that a vulnerability is actively being used by an adversary, sure, it’s more responsible to disclose sooner, but in general you want to take into account the fact that the vast majority of engineering organizations aren’t set up to patch and/or update on a dime, which means that if you disclose immediately you now have a window of time in which anybody with a pulse and an internet connection can exploit the vuln, which is why a 90 day disclosure period is usually practiced.