In my experience with the cryptographic security space at Facebook, what happens is the security team reaches out to you and starts a conversation. You collaboratively establish the severity, acceptable mitigation options, and appropriate timeline. There might be a little bikeshedding over various degrees of ideal option (it's more fun for the crypto guys that way). They might volunteer to do the work. You review the diffs, they're good, it lands.

They're smart people and the team knows how to collaborate with random infra/product teams.