I truly don’t understand why you decided to take the stance of setting them deadlines and disclosing the vulnerability if they miss them. I understand you had good intentions, but I also can see how this can look like unnecessary escalation and even like blackmail to someone outside the industry, like an insurance manager or a lawyer.
I agree that disclosing a vulnerability in a major web browser or in a protocol makes sense because it’s in the interests of the humanity to fix it asap. But a random insurance firm? Dude, you’re talking to them as if they were Google.
If you really care about them and wish them good (which I believe you do!) you should’ve just left out the deadlines and disclosure part and I don’t think cc’ing the national agency was that necessary given the scale of the problem. Maybe should’ve just given them a call and have had a friendly chat over the phone. You would’ve helped them and stayed friends.