Security researchers have a duty to users and industry first, then to the specific companies they are disclosing to. Most companies, without time pressure, do a

Security researchers have a duty to users and industry first, then to the specific companies they are disclosing to. Most companies, without time pressure, do absolutely nil to fix the issues they are made aware of. It's completely fine to discuss or request a different disclosure date when communicating with researchers. The delay is their protection against inaction.