It is in the public's best interest to demand timely fix because you never really know whether bad actors know about it. A demand has no teeth, therefore you have to make a threat (fix in 90 days, or we disclose publicly). A threat is only good if you have a track record of delivering on it without exceptions. Therefore, it isn't an option to not disclose it at 90 days.