The PHP situation was only particularly bad because (of the nature of the vulnerability, but also) the people handling it made some very inappropriate choices, like being way too attached to the embargo even once the complete reproduction was circulating publicly on Twitter. That's not inherent to the security patch process, and hopefully doesn't become the norm.

Keep in mind that every PHP application globally was advised to completely cut network access or entirely shut down until the patch was available, so this was global critical infrastructure failure. I'm surprised lives weren't lost as a result.

And no, from what I've seen, it had nothing to do with the few entities that did rightly ignore the embargo after the exploit was already being circulated, even though the PHP devs are seemingly still putting resources into spinning it that way.

I'm sure the defender community will eventually come up with a way to patch security vulnerabilities just about as fast as they can be discovered and exploited.