I'd like to express my dissatisfaction that the "big guys" are basically getting free security over getting earlier disclosure.

Just saying "hey blocking multipart uploads can mitigate most of attacks early would save people so much trouble. Of course not every CVE will have workaround but many do and whole secrecy about releasing it is only to benefit of few big tech companies and nobody else