And what do we learn from this?

Pressure on disclosure date until Bug bounty, then relent.