The Avada issue has been patched for more than a month. When you announced it to your customers on Twitter you did not mention that there are important security fixes in the release. The fact that it took Envato a month to get an email out to them is something customers should consider. A post was added to your wiki on 5/18 (more than a month after the release) but there has still been no public announcement on your blog or Twitter or a channel that the public would follow. When WordPress delayed disclosure on a critical vulnerability it was for only 1 week. After that time had passed, they publicly disclosed it on the blog. Furthermore, they credited Sucuri and linked to their post with the technical details of how the vulnerability might be exploited. Once it's patched and publicly disclosed, it's on users to update.