I didn't know that Netgear already has proven to not be following coordinated disclosure; generally I think it's fair to give some time to the vendor.

I like how Google Project Zero does it: give time, but don't extend indefinitely.