I'm not disagreeing with you, and I don't understand the market.

But surely, unless the regulation is written in an especially thoughtless way, the clock would start at either the time the device manufacturer has access to the upstream fix, or the time that the manufacturer provides an update to any of their devices (which implies access to an upstream fix).

So public source release would only impose additional burden on device manufacturers if it is the first time that they are seeing the upstream fix.

Right?