Not shining a spotlight is worse. The important thing is providing time to address the found vulnerability, ie. responsible disclosure. For which OP has indeed provided a timeline.
The debate has long since been settled comprehensively in favor of openness.
I don't know why you picked a random date 2 weeks before publication instead of the relevant one:
2024-12-27: Current vendor of MESH identified as Hirsch (subsidiary of Vitaprotech Group) and contacted
They were contacted 7 weeks before publication
and
2025-01-11: Hirsch product security responds requesting details and are asked if they intend to alert clients
They responded 5 weeks before publication, and so were aware of the issue for at least 5 weeks before it was disclosed, during which time they did nothing about it
The debate has long since been settled comprehensively in favor of openness.