Yes. I was referring to post 90 days.
If they confirm the problem, but say they need more time, how long do you give them?
Say, another 3 months. They if they replay the same movie then, it will become clear they do not want to fix. Possibly because the exploit is being used for profit.