It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines
(I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)