Existing users who do NOT run brew upgrade between the rename PR merge and the new-formula PR merge will be silently swapped to the new vendor's package on their next brew upgrade — no warning, no confirmation. Reproduced on a real machine.
Conversely, existing users who DO run brew upgrade during the rename window are protected: the rename mechanism moves their Cellar directory to the new name, so the later handover doesn't touch them.
So the practical function of a "migration window" is not "time for users to notice the rename" — it is "time for users' Cellars to be physically renamed via brew upgrade, before the original name starts pointing at a different package."