I find it incredibly naive that they’d hope it would not leak after weeks/months of embargo.

Being given advance notice of an upcoming security fix is an immense privilege, organisations should turn around quickly when given such information, they shouldn’t be given more than a couple of days to update IMHO, it’s not like the rest of the world can wait.

Keep in mind that some of the organizations are presumably patching ancient versions of PHP like 5.6. I am sure this is a process which takes considerable time, especially as upstream PHP has washed their hands of such old versions and the downstreams are effectively on their own.

(It is often much cheaper for an enterprise to just get a long term support contract than to properly upgrade to a modern PHP stack.)