i would recommend you email the vendor, ask give them 14 days to reply on whether they are interested in having a 60 day window to issue a fix (without telling

i would recommend you email the vendor, ask give them 14 days to reply on whether they are interested in having a 60 day window to issue a fix (without telling more than "remote exploit, full camera access"). If they do not reply, publish immediately, if they do, you let them know how it works, and give them a date in the calendar for when it will be disclosed publicly.