Another case of Google not following their own rules. But they're happy to hang others out to dry when they exceed 90 days.
https://googleprojectzero.blogspot.com/p/vulnerability-discl...
There are several cases in which deadlines were extended way beyond 90 days. And in the post itself, the researcher points out they could (and, in hindsight, feel they should) have imposed a hard 90 day deadline.
You are not obligated to keep any secrets about your own research into a product that has been publicly released for everyone to do research on.
Also if I understood it correctly, it seems as though some devices may require a factory reset to apply the new firmware? If so, for a lot of devices this still isn't fixed.