Because not everyone has updated yet, not everything related to the vulnerability is fixed yet, the vulnerability is kind of bullshit, people are still figuring out if there are lots of adjacent or similar vulnerabilities to handle, etc. Not sure which of these is the case here.

You can, of course, disclose vulnerabilities whenever you like. But don't expect to get a bounty if you piss off the vendor in the process.