The initial response was very quick, but honestly: Fixing such a simple XSS hole on a web application shouldn't take 7 days. In the age of automated testing and continuos deployment, escaping that parameter is trivial.

Granted. If you have a systemic issue and you need to fix your framework to always escape unless told otherwise, that will take longer, but it won't prevent you from quick-fixing just the reported issue.