Why are these things being disclosed before fixes have been rolled out? Is no-one following disclosure protocols any more?

At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.

If it was even enabled that is.