They usually are. The primary function of embargos is to force bugs to be patched, specifically by the concept of an end of embargo where you just release it, fixed or not. They exist because it used to be(and for many companies still is..) that you would report a securty issue and they simply ignore it, "security through obscurity".

Embargos exist as a forcing function, in enterprise often 90 days, and as a good faith communication effort, theyre saying "I am doing the courtesy of telling you about this issue. You have plenty of time, 90 days, to fix this, and I may be able to help. But if you dont fix it promptly, everyones going to know. In exceptional circumstances and conditional on your good faith this can be increased, but you cant just put security off forever"

This is also why many, including the kernel, work to reduce embargo periods. The kernel only accepts embargos up to 7 days, or hard maximum 14 days in exceptional circumstances, for example.

What they dont exist for is to ensure downstream forks(in the context of the kernel, all the distros that dont roll, either on a upstream stable or upstream LTS) bother to get patches, or prevent others from exploiting an issue, because thats just "security through obscurity" again. It must be assumed that Threat Actors(TA) have just as much, if not more, capability to find and use these exploits as those reporting them, and the TA's arent trying to get them fixed.