So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? T

So what's the intermediate step on the spectrum? Publicly call out the vendor and model, yet vaguely enough that others will have to find the specific gap(s)? Tell the press? If one publicly discloses some mitigation it's usually enough to give malicious actors enough to go on anyway.