Telling people about what you have discovered is bad if you can reasonably tell that those people are bad actors who will use the information you are giving the

Telling people about what you have discovered is bad if you can reasonably tell that those people are bad actors who will use the information you are giving them to do harm. That's why it's responsible to tell the people who can be responsible for mitigating the problem in sufficient time for them to propagate a fix before publicizing the exploit in the knowledge that you are giving it to bad actors. The fact that the vulnerability existed before and may have even been being exploited does absolutely nothing to change this. If it was already being exploited but isn't publicly known then irresponsible disclosure simly makes the problem worse by increasing its availability to more bad actors who weren't previously in the know.