I blame them. This is the world we live in. Google was nice enough not to lock down their ecosystem (like Apple), so in a way they're being sensitive to your concerns. Epic should not be punishing Google for being permissive. This way of distribution should be the exceptional case; for when Google is being unreasonable (eg. censorship), or for more advanced situations. This isn't the ideal, general purpose channel for releasing software. That's what the app store is for. Epic is putting their users at risk to save some bucks.

On a side note, I don't love Google's rules as I understand them. They seem to punish prompt action and honest communication in some cases (eg. this one). I think you should just get the 90 days if they're willing to allow it. Of course, this is always their call.

EDIT: Other users are saying the short deadline is because the public will be made aware of an exploit, due to existence of a patch. I did not think of that initially, but it does make sense