That isn't surprising. A security bug that is known only to the vendor does not cause any damage in reputation or finances. In fact, fixing it costs money for n

That isn't surprising. A security bug that is known only to the vendor does not cause any damage in reputation or finances. In fact, fixing it costs money for no perceived economic benefit. I guess the "responsible disclosure" culture is partly to blame here. If you get 90+ days to fix any vulnerability, then software that ships with (internally) known security issues is much more viable.