Much like a "due process" standard so-called "responsible disclosure" is only anything like responsible if you have set out how you'll be responsible in advance and then stuck to those rules. If reality argues in favour of changing your methods so as to be "more responsible" whether that means disclosing sooner, or later, to different parties or in a different way, that should be a _separate_ process which changes future policy.

Google's Project Zero is an example - regardless of whether they're finding holes in Android or iOS, it's the same policies, Google's Android team needs an extra week? Same result as when Apple's iOS team asks for one.

If you don't have the policy set down in advance, you're vulnerable to manipulation which will invariably be a bad idea as well as leaving you looking _less_ responsible than you intended.

The outcome is that bad guys had _over a year_ extra to read everything FortiGuard products were doing without customers having any awareness this was happening.