Exploit developers don't wait until the vulnerability is announced. Pretending a critical bug fix is really no big deal until after people patch only gives them more time to exploit, because nobody will upgrade until they're told it's urgent. If then.