The precautions a cautious user will want to take when armed with this information don’t really change or become more burdensome whether there’s one group of at

The precautions a cautious user will want to take when armed with this information don’t really change or become more burdensome whether there’s one group of attackers or many, so I don’t see how that changes the calculus at all. It’s also probably not a terribly great assumption that no one else has independently discovered this vulnerability that’s already been independently discovered twice. Caution suggests we should assume this is in the wild and act accordingly.