This is correct, which is one of the reasons that I personally support full disclosure for everything.

I didn't know that Netgear already has proven to not be following coordinated disclosure; generally I think it's fair to give some time to the vendor.

I like how Google Project Zero does it: give time, but don't extend indefinitely.