I think it is unreasonable to expect every semi-public coffeeshop style wifi to be operated by someone manually compiling and curating patches for the router firmware every time a vulnerability surfaces. An embargo would have kept a lot of users safer because their neighborhood script kiddies wouldn't be able to go on a hacking spree. I don't think a 12-24 hour delay coordinating patches with vendors would matter for the case where a select few elite blackhats were sitting on the same bug, because they most likely have had the bug for months or years already.

I don't expect it of coffee house wireless operators, at all. If some startup comes into being that manages those wireless networks for the coffee shops, I will very much expect it of them.

I generally don't have an issue with the security decisions of people who don't know better. I do have a problem with people who should know better and essentially refuse to because of cost and convenience and availability concerns. Security should trump availability most of the time, but almost never does in our industry. That is messed up.

Agreeing on those points :)