> Third, the response and fix time is actually good? If anything - 5 days is incredibly good turn around.

Yes. Especially since the code wasn't actively being exploited in the wild.