I agree in general, but

Maybe I’m over simplifying it though, I don’t know how their org operates.

This is exactly why just sticking to the 90 day standard is better. For the supposed security researcher it’s a CYA move at worst.