You can't assume good faith on the part of your attacker in building your threat model.

Also: it could have been much worse than this irresponsible disclosure, at least it was disclosed.