“Give them a few weeks to clean up code and release it (which is very normal) ”

In the world of security critical systems, this is completely abnormal.