I'm not sure this is "naming and shaming" because I don't seen an intent to shame. They disclosed the vulnerability privately, waited months for patches, and were commended by the organization with the vulnerabilities.

There's no shame here, this was a mistake, probably made by a human, and ultimately corrected. Nobody seems upset by the outcome!