This is a foundational policy question in security research, and Project Zero gives a lot of detail on its aproach, e.g.

https://googleprojectzero.blogspot.com/p/vulnerability-discl... https://googleprojectzero.blogspot.com/2020/01/policy-and-di...

Historically, vendors often refused to allocate time to patch things for anywhere from months to years.

Leaving vulnerabilities in products for an extended period of time is a problem, and adding a deadline helps to ensure that important security issues actually do get triaged and addressed.

As a recent project zero blog post about their policy calls out (https://googleprojectzero.blogspot.com/2020/01/policy-and-di...) "We've seen some big improvements to how quickly vendors patch serious vulnerabilities, and now 97.7% of our vulnerability reports are fixed within our 90 day disclosure policy."

It sounds like it's working as intended. The only way you can make it actually work is to make sure it has some teeth though, hence you have to actually disclose when you say you will.

> doesn't it cause more harm than good?

Microsoft is harming its users by not fixing a security vulnerability. In this case, it's even more clear since there's "in the wild" exploits. Project zero's just helping to raise awareness of the harm microsoft's causing.

It is in the public's best interest to demand timely fix because you never really know whether bad actors know about it. A demand has no teeth, therefore you have to make a threat (fix in 90 days, or we disclose publicly). A threat is only good if you have a track record of delivering on it without exceptions. Therefore, it isn't an option to not disclose it at 90 days.

A while ago, responsibly disclosed bugs took an extraordinarily long time to be patched. Disclosure deadlines ensure things are patched in a responsive manner. They only work though when the reporter actually follows through if the deadline is missed (and has standing & legal projection to execute like the Project Zero folks).

It's not even remotely exploitable, which from the perspective of the fact that the vast majority of computers are owned and used by a single-user, makes it a very low to zero risk.

The stakes are very different for disclosing a remotely exploitable vuln.

If you've ever try reporting vulnerabilities, you'll see that some companies won't ever fix the problem until it is widespread.