The study looked at data between January 2019 and December 2021 to determine how much time developers took to fix security issues.