"We agreed on a 150-day disclosure window". Isn't that longer than Google Project Zero gives to release fixes?