I'm curious what communication happened in that time. I'm not inclined to give Microsoft the benefit of the doubt but "vulnerability reported" doesn't necessarily mean "we sent full details in a clearly documented way to the right place where it would get in front of a human".