Disclosure before giving the manufacturer time to respond should be reserved for extreme instances where an exploit is already being used in the wild or a high risk to many users.

Downloading .exe files without TLS is dumb but the threat model of this being used in an attack is pretty niche, since an attacker would need to spoof DNS to resolve a fake download URL. The only way this would happen would be if the ISP were compromised or the local machine is already compromised.

Thus I don’t think this was appropriate to disclose before giving the vendor time to respond. Exposing such a niche surface area for attacks greatly increases the likelihood of the vulnerability being used in targeted attacks while Gigabyte is busy trying to install Certbot.