This feels like two useless extremes. Enough information to give an idea of severity / class of vulnerability with the patch itself and the writeup a week later

This feels like two useless extremes. Enough information to give an idea of severity / class of vulnerability with the patch itself and the writeup a week later when everyone has had a chance to patch and those skilled hackers Rapid7 cites have disseminated the bug from the release diff.