There's no real impetus except paranoia if the change is unannounced. You don't have to detail the vulnerability, just inform people that somewhere, one exists,

There's no real impetus except paranoia if the change is unannounced. You don't have to detail the vulnerability, just inform people that somewhere, one exists, and that this is in fact a countermeasure. Without doing that, you don't shift liability, you don't actually get people out of harm's way, you don't really benefit at all.