I think a company that goes: "OMG this is a serious vulnerability and there's lots of instances of it throughout the whole system but we'll fix ASAP!!" deserves a longer grace period than another that says: "SO WHAT man, our thing just works...".