That doesn’t mean they aren’t upset. Two years ago I spoke with someone on the CoreOS team at a conference and he expressed dissatisfaction at Project Zero. It forces them to halt other work they are doing to design fixes for these bugs, as they often get pressure from Google close to the 90-day window. One fix, he explained, related to process management and would affect all OS builds. Getting that fix integrated and tested into all recent macOS and iOS versions takes time, despite the 90-day window.