> Do you want to keep the world vulnerable for a 6 month window?

There exist far more bugs than discovered bugs. By revealing it, I put some people at risk (those who fail to update), and by hiding it I put more people at less risk (everyone, but only if someone else discovers the bug).

It's a tradeoff, but 6 months is a good window for most people to update, while there still not being too much chance of the bug being independently discovered.

> most European university researchers are funded through taxpayer money

This is absolutely not a given. While it might be partially true, they are frequently also funded through corporate grants.

The only European country where I'm somewhat familiar with research funding is Sweden and at least there direct corporate funding is a tiny sliver of the overall university research budget. And even when companies do fund research projects much of the funding is things like letting their researchers work 'for free' on the project or giving free access to data, equipment and licenses rather than cash

I only really know two northwestern (European) countries and they are both not Sweden. Corporate funding there is "strings attached" money, both for direction and scope of the research (and in at least one case a final say on whether or not research gets published). Corporate funding is also somewhat expected, as working from just government money is a huge outlier (it is not enough).

It's interesting to see that policies differ so much even inside of the relatively wealthy parts of Europe :)

To clarify slightly. Corporate 'co-funding' and cooperation is not uncommon in projects (and is in fact a requirement for funding in many cases), but the amount of actual cash this adds up to is a tiny percentage of the overall national university research budgets.