* http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect...
See also these:
In this particular case, most of the fix had to be done in the operating system (the new microcode only enabled extra functionality needed by part of the operating system fixes), so it makes sense that operating system developers were allowed (and required) to prepare in advance. The three most relevant operating systems are Windows, OSX, and Linux; for Linux, one of the most important distributors is Red Hat. That gives two of the groups which were notified in advance: hardware (Intel, AMD, ARM) and operating systems (Microsoft, Apple, Red Hat, a few others).
This is not to diminish the work done upstream by less independent people. Dave Hansen, in particular, is the one who actually got the code to function.
The Spectre mitigation is expected soon but there is no ETA on Meltdown yet: https://www.reddit.com/r/freebsd/comments/7och5a/freebsd_was...
As others say, OpenBSD indeed violated embargoes a few times.
It's similar to the Recalls of Takanas airbags in this regard. The manufacturers are informed and they tell us the consumer to bring in our cars. I'm not qualified to replace an explosive airbag, even though I drive a car daily as a lay person.
Imagine how it would work out in your airbag analogy if only Toyota and GM knew, and they withheld information for months while they worked on their own fixes, meanwhile the public remains in danger and other automakers have no chance to implement their own recall plans.