Can these far more important vulnerabilities be fixed as easily as turning off a debug flag? Personally, in the rare cases when a fix is easy I'd expect it to

Can these far more important vulnerabilities be fixed as easily as turning off a debug flag? Personally, in the rare cases when a fix is easy I'd expect it to be deployed promptly (and 3 months doesn't sound reasonable to me).