There are all kinds of options, perhaps national CERTs could override vendor decisions, perhaps something else, but we can't simply assume good-faith behavior from every vendor.
The whole reason why we have various community resources for tracking vulnerabilities was that relying on vendor behavior didn't (and doesn't) work, and it's up to the general public to figure out how force appropriate behavior with e.g. responsible disclosure deadlines, public shaming, etc; and CVEs are part of that mechanism of the community pushing reasonable standards on vendors whether they want it or not - since many vendors often have a clear financial motivation to act against user's interests, downplay and ignore vulnerabilities, and CVEs are for the benefit of system users, not vendors, they are how security researchers can communicate risks to the system users, with or without cooperation from the vendor.
