Not to downplay your thought experiment but Vulnerability disclosure has been debated to death in the infosec community, ad nasuem. Seems like someone always ch

Not to downplay your thought experiment but Vulnerability disclosure has been debated to death in the infosec community, ad nasuem. Seems like someone always challenges it when it comes up in the press on Twitter where it seems there will never be a hard answer here that will satisfy everyone. The consensus and IMO best solution is follow the standard of disclosing and then waiting a reasonable amount of time before telling the world. But there will always be exceptions to the rule where threat models are different or the tech/business environment is different than fast moving software… like old school medical companies with slow moving fixes for medical devices. The latter seems like it has more responsibility to wait but public pressure on them to move but they also typically have teams of lawyers who are disconnected from infosec/tech reality.