I think you are underestimating the importance of fixing glaring security bugs ASAP when they become public knowledge instead of denying or ignoring them for years.

Also, a DNS leak is potentially much more dangerous for a minority of people than any locally exploitable bug.