That's true, but it glibly ignores the reality of vendor lock-in. The average non-infosec human is not going to switch devices because of a vulnerability whitepaper. This "vuln-insensitive user" is better served by giving the vendor a longer timeline to take care of the issue, rather than releasing exploit details two weeks after someone changed a status on a ticket.