This is why I have an issue with Project Zero. You will NEVER patch all the 0days. There are only a few bugs that I've seen that were so impactful (Heartbleed f

This is why I have an issue with Project Zero. You will NEVER patch all the 0days. There are only a few bugs that I've seen that were so impactful (Heartbleed for example) that it made a massive impact to release and patch it. And as you implied, patching an 0day often publicizes a new vulnerable attack surface with new bugs to follow. The real way to fix security issues isn't to find new exploits and expose them. It's to architect new ways to prevent whole families of exploits from being possible. I've only really seen Project Zero do one sort of recommendation in this way. Outside of that, I don't feel that them finding 0days and releasing them is actually a significant improvement on security because they aren't even close to plugging all of the holes (or even enough to really make a difference).