If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them.
So maybe that guy was a little trigger happy. Great hack, though.
"Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest.
Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act?
Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".
I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty.
Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.