Nope, Google is not obligated to reply at all nor do they have any obligation to hold on these announcements. There are no faults for Google here. Their 90-day policy is just a courtesy call that comes with an exception, the moment a patch is made available, the disclosure will be made public. Google is not being paid nor asked by Epic to find reports, Epic has no rights to anything.

Google found the bug, they have the right to disclose it however they want. There are no legal standards anywhere that requires anyone to do anything with bug reports.

Epic doesn't have any rights here, it sucks but they're not entitled to anything. I hate this because I've experienced this from Google before (at work), I would love to have that right to hold up to 90 days before we can notify people but until there are legal standards, there is no right.