The point is the "lock" can't be immediately replaced, by the user, in most software exploit scenarios. That's why you delay, so the company can ship a new "lock" so that when malevolent forces who didn't know of the exploit learn of it the new "lock" is ready to do duty.
It depends on the specifics of what's being exploited but in general I think a short delay between informing those who can fix it and those who will exploit it is generally more moral.
That really isn't an option for most users. People who use a password manager are pretty much forced to use that password manager, at least if they're using it properly. Most users won't know how to export it to a CSV and then use that without a browser extension and/or import that to another password manager.
Isn't that the right thing to do for truly sensitive passwords?
I'd much rather transcribe my financial account passwords to paper, or not log in for a couple days than have multiple months where a vulnerability might be exploitable
It depends on the specifics of what's being exploited but in general I think a short delay between informing those who can fix it and those who will exploit it is generally more moral.