From reading the linked document, this sounds fairly reasonable; although the security research was prepared for the court during 2021, it has only been shared with the vendor as of 2022-02-04, so the remediation process (including updated software builds, testing, customer deployment) is likely in the early stages.