Seems like you dont understand the silent agreement in cyber security and how things are handled.
After a disclosure in private (April) Enpass rolled out a temporary fix in May. While working on a permanent solution, the world was notified, that this problem exists (August) and then Enpass rolled out a permanent fix just 4 days later (some popular managers still have no fix [1Password, LastPass, KeePass, iCloud]...)
This is still common and in my eyes quite a rapid reaction.
Also, change logs indicated the fix in May already.
There is a common ground that has to be found between telling users and risking "bad guys" actively acting on the notification and not telling the users and increasing the change of the vunerability not gaining a lot of attention. It's a fine line.