Isn't this all MS's fault for having a security flaw in their system? If the Project Zero programmers were independent or malicious, they could have sold this

Isn't this all MS's fault for having a security flaw in their system? If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window. Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.