Its not even the benefit of the doubt. They still publish and name and shame at 1 month. Its just to avoid harm to the users who the security researchers are ostensibly working to protect.