Not to mention that all the bad guys had to do to get the private key was unpack the firmware image, so they've probably noticed long ago.
If what you said were true then zero-days would be always ignored and not a concern.
How does that follow from what I said?
It's not optimistic, it's what a responsible vendor is supposed to do. By not following responsible disclosure the researcher has lifted the vendor from the possibility of organizing a proper response.
By the way, I meant coordinated disclosure and I am not aware of Netgear not doing any at all, never.