> imho it depends on the vuln. I've given a vendor over a year, because it was a very low risk vuln.

But why? A year is a ridiculous time for fixing a vulnerability even a minor one. If a vendor is taking that long its because they don't prioritize security at all and are just dragging their feet.