Not sure that follows, since 'bad guys' aren't monolithic. It may still be less damaging for only 'some' bad guys to be using the vulnerability, and continue t

Not sure that follows, since 'bad guys' aren't monolithic. It may still be less damaging for only 'some' bad guys to be using the vulnerability, and continue to think that only they know it. (Thus, they use it sparingly). Immediate full disclosure means 'all' bad guys learn of the vulnerability, and then perhaps rush to maximally exploit (knowing they're in a race to use ASAP or lose their chance).