An impulsive company would automatically opt-in for the grace period, using the rationale that the less people who know about the bug, the less damage can be done to Cisco and their customers.

A wise company would consider disclosing the bug even without a patch, using the rationale that their customers deserve to know that the bug exists and make decisions and implement workarounds to mitigate it.

In other words, public disclosure may be in the best interests of Cisco's customers.

Grace periods exist as an incentive for these companies to take action. Maybe Cisco thought they were calling their bluff... but they weren't bluffing.