I dunno, your criteria sounds too broad. I think there's absolutely value to the user in having vulnerability disclosures distinguish the case of "exploit exis

I dunno, your criteria sounds too broad. I think there's absolutely value to the user in having vulnerability disclosures distinguish the case of "exploit exists" from "no exploit exists". It's all well and good to just advise everyone to always update their systems, but in practice people managing systems need to deal with gray areas. Do you shut systems down proactively? Revoke certs for hosts running the old version? Change network access protocols to require the new version? All those decisions have measurable costs, and in practice "we believe this is unexploitable on the OS version you are running" is going to change the decision for some users.