Does the timer start at upload, or does the timer start at mass exploitation?

Not a bad idea, but we'd need to have evidence of the former case to make it mandatory and widespread.

IIRC, many times it's compromised credentials of maintainers, which are caught very quickly, so that's evidence of the former case.