As someone who doesn't work much with software teams, can someone fill in my gaps for understanding timeline.

I'm imagining after a security issue is identified, the steps taken are roughly in the below order and close-ish for the date. I guess my question is, why does it take 20 months from start to blog post?

-Contain the issue (1wk) -Remove the threat (1wk) -Build up remedies (a few months) -Check and recheck what happened to make sure you're accurate when submitting final reports (a few months) -Release a blog post (1month)

The timeline is a cool day by day instance, but I just don't understand the larger timeline.