Not really that long, especially when compared with how long other security issues take to be patched. If they rushed a patch out there would no doubt be problems from a lack of testing. At least the patch has been issued before an attack has emerged in the wild.