This is the problem with 'responsible disclosure.' Companies will just drag their feet indefinitely, like an undergrad who stalls and manages to talk the instructor into assigning them an incomplete instead of just failing them outright. Just flunk them and don't reward that behavior: full disclosure.