The right to freedom of speech means Google can say what they want when they want about the vulnerability, giving them the right to set a deadline.
There are certainly companies doing much worse than setting 90 day deadlines. For example VUPEN, Hacking Team, and GrayKey selling undisclosed vulnerabilities to "good" governments, and other companies servicing the shadier governments[1].
[1] https://www.bloomberg.com/news/features/2017-01-18/the-post-...