The requirement to report issues to regulators per the CRA does not mean those reports are public. The CRA is not about public disclosure at all. It's so regulators have insight into the cybersecurity landscape and can help with coordination if necessary. And other regulatory goals.

So there is no incompatibility with coordinated disclosure.

(There are unresolved issues w.r.t. the CRA mandatory reporting requirements, but this isn't one of them.)