> The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's being fixed.

if it’s live it’s already being exploited. simple principle, but very effective.