That's still more or less 120 days ago. Well over the 90 day typical window.

I'm not saying it's bad (I'm pretty close to a disclosure absolutist), though I don't really know what the norms are for hardware attacks --- both papers are well past the normal coordinated disclosure window for software.

The vendor requested embargo timelines can get pretty crazy.

Intel requested an embargo for 21 months for SRBDS/Crosstalk.

For Downfall, a more recent one, Intel requested a 12 month embargo to release a microcode update.

For all I know, that might be a reasonable ask for these kinds of vulnerabilities --- not that researchers have to honor them.