I have a remote DOS and possible code execution on one of the world's most widely deployed desktop applications. Their security team has been on top of it (got back an initial human response and responsible team member within 48 hours, etc), but the nature of the beast means that all subsequent steps take weeks to months. I can't remember off the top of my head, but I think we're at 4 months and counting.

That is very fast for something at a huge scale like Gmail. They had someone responsibly disclose the exploit so they fixed it quickly but not so quick as to destabilize Gmail by not properly testing/deploying. Making changes to software used by millions is not that easy.

The last exploit I found in windows took about 6 months to get patched (this was in 2010, they may have improved). It was a 'ping of death' style instant bluescreen from one packet kind of exploit. 10 days is _nothing_.

11 days? Two weeks? A month? Never?

Not every company values this sort of feedback from their users. Some go out of their way to prosecute those that break their services this way.