there's a lot of arguments here that delaying the patch release gives a false sense of security because we cannot prove that bad guys do not already have the ex

there's a lot of arguments here that delaying the patch release gives a false sense of security because we cannot prove that bad guys do not already have the exploit, or because they will develop one within hours. if to have real security we must prove that bad guys do not have an exploit, would that not lead to a conclusion that there is no real security at all? it is safe to assume that exploits for undisclosed vulnerabilities exist. and, regarding the "several hours" argument, didn't the release of the exploit reduce those several hours to zero? instead of not being sure if the bad guys have the exploit, or if they will develop it in 1 or 3 hours, we are now certain that they have it. instead of a sense of false security, we currently have no security. it seems obvious that little to nothing can be done about those who already have the exploit. and given the wide agreement that developing it will take a couple of hours, then wouldn't an optimal exploit release time be 1-2 hours? and as far as i could notice, only one very downvoted comment mentions that a motivating factor for a quick release could be to be the first to break the news. certainly sounds like good PR for a security company. why is this unspeakable? :)