The 90 day period is the grace period for the dev, not a demand. If they don't want to fix it then it goes public.
That’s how open source works.
If this keeps up, there won't be anyone willing to maintain the software due to burn out.
In today's situation, free software is keeping many companies honest. Losing that kind of leverage would be a loss to the society overall.
And the public disclosure is going to hurt the users which could include defense, banks and other critical institutions.
The 90 day period is the grace period for the dev, not a demand. If they don't want to fix it then it goes public.