You can argue about the timing of disclosing specific vulnerabilities vs. when fixes are available. But the idea that we should all be (shh) don't tell anyone that this broad practice is vulnerable to bad actors is idiotic.