The bad actors pay people to find these issues. It's prudent to assume that blackhats know about this already anyway. Thus, it's beneficial to push fixes asap i

The bad actors pay people to find these issues. It's prudent to assume that blackhats know about this already anyway. Thus, it's beneficial to push fixes asap in order to minimize the window for the blackhats. It's a choice between visible pain and invisible weakness. The early disclosure hurts and amplifies the issue. However, the malicious actors you need to worry about would be glad for every day without disclosure, because every day without disclosure is profit to them.