Might get downvotes for this but my stance is against publication of a PoC until most users are confirmed to have patched it. Hear me out though, I don't think

Might get downvotes for this but my stance is against publication of a PoC until most users are confirmed to have patched it. Hear me out though, I don't think it should be legally prohibited but I still do consider it unethical to publish a working PoC. Before I present my reason let me give you a real life example I experienced first hand: A certain rce exploit against a webapp was published along with a PoC exploit on github. Within 24 hours there was a large volume of attacks against servers running that software,compromising them and installing cryptominers. Worst part? Turns out the patch wasn't even done right by the vendor. My point is this: yes researchers have every legal right to publish a PoC and I support that. Ethically speaking, there very real consequences to businesses and individuals when these PoC are made public. Sure, even if there was no PoC the attackers can reverse the patch. In my experience, most of the attacks for an exploit with a working PoC use the researcher's PoC script line for line with only the needed modifications. The difference here is the likelihood of an attack and the size of the threat. Without a working PoC, the amount of attackers reverse engineering a patch would be dramatically smaller than with a working PoC. Not only that, the amount of users that should anticipate a high likelihood of an attack leveraging a vulnerability with an unpublished PoC is low. Objectively speaking (at least for a short while after the patch) releasing a PoC reduces security for the users of the software. That being said I understand the educational merit of a PoC and a lot of vendors won't respond without some arm twisting,so there are exceptions. It certainly isn't a black vs white clear cut issue. But yeah,generally speaking I am against publication.