https://seclists.org/oss-sec/2023/q3/259
> After our disclosure timeline was exceeded by many months, we notified the maintainer of our intent to publicly disclose these bugs, at which time we were told, "you do what you do."
"The ZDI contacted us in June 2022. We asked about details but didn't get answers we were able to work with. [..] Next contact with ZDI was in May 2023. [..] The remaining issues are debatable or miss information we need to fix them."
I have no experience with anyone involved and don't really know anything more than this; just pointing out there are differing accounts here.