But, do they tell you about the vulnerabilities before they exploit them?

Maybe they put it like this to exempt themselves...