They were aware of these bugs for (at least) 16 months. They could delay releasing new chips until they addressed the problem, even if it took them another year. They did not. Instead, they released a chip with a widely known critical vulnerability. That's on them.