IMO the metric should also consider how long it took them to patch it. Everyone has zero days, that's life. But there is no excuse for not patching a critical vulnerability.