Legitimate vulnerabilities could face delays before they are reviewed and fixed.