30 days in which to fix the whole security of the systems and then make it public? What about companies like Microsoft that need at least 90 days to fix a privi

30 days in which to fix the whole security of the systems and then make it public? What about companies like Microsoft that need at least 90 days to fix a privilege escalation bug?