You are not harmed by someone discovering a vulnerability and telling you about it. Obviously that benefits you rather than harming you. You are harmed by them

You are not harmed by someone discovering a vulnerability and telling you about it. Obviously that benefits you rather than harming you. You are harmed by them discovering a vulnerability and telling the world about it. And if they discover a vulnerability and tell both you and the rest of the world, the harm may easily outweigh the benefit. Suppose I go wandering around the city where you live, checking for unlocked house doors. I find that you've left your front door unlocked and gone on holiday. I then wander the streets shouting "Thomas's house is unlocked and no one's at home!". I also phone you up to let you know your house is unlocked. It was your fault, not mine, that the house was unlocked and no one at home to deter burglars. In principle, anyone else could have come along and burgled your house, if they'd found it before I did. None the less, I think that in this scenario I have done you wrong.