Because you need a certain amount of notice and in this case drama to be created so people know to update ASAP, before the exploit is out in the wild. As soon as these patches are out it becomes a lot easier for any actors to figure out exactly what they are patching, and how to exploit it.

Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.

Once the fix is released, people will reverse-engineer it and use the exploit on pages that haven't updated yet.

So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.

The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed

As far as I understand it, releasing this fix also broadcasts the vulnerability.

Scheduled release gives the option to turn things off on a set schedule while applying patches.

e: turns out several people answered this. Whoops.

Who knows? Not any official explanation for this.