The questions you need to ask are what is the cost of the alternative? What is the cost in the exploit being used in the wild? What is the cost of the PR shit

The questions you need to ask are what is the cost of the alternative? What is the cost in the exploit being used in the wild? What is the cost of the PR shitstorm that would come your way? How much business could you lose? Customer confidence? Is this an exploit that could be devastating to your continued operations? Would it lead to legal action? What are your duties to inform customers/users/legal bodies? Will there be any fines involved? You may need to retain an expert PR firm to handle the communication to the world to put a good spin on the story, another cost. Did you breach GDPR? Does the data that could have been leaked reveal business practices you'd rather keep secret? Is there any kind of internal risk of leakage? How far does the exploit go? Can it be combined with other exploits that could be used to gain access to internal systems? The industry has collectively decided that exploits have a value and I'm not sure these factors are taken into account. You should look at examples of companies that have suffered an attack and look the damaged caused (for example, Experian, Blackbaud come to mind) to understand the impact it can have. How much does it cost to have a CEO tweet the stock price is "too high imo" and causes a dip? That may cost him potential investors to think again. Of course, you can't know that person who was just about to give you $50,000 worth of business decided not to because of how you handled the situation but it's always a possibility. I know I've made (small) decisions like this because I didn't like how it was handled or didn't agree with some of the details, and I no longer consider myself a possible customer as a result.