Does than mean the procedure of responsible disclosure was followed but vendor failed to patch on time?