Meanwhile, your average enterprise app team has like a 30 day SLA for remediating critical vulns, after which they become overdue.

Unfortunately speaking from experience in AppSec