That sounds like the opposite of the goal. The point is the disclosure: telling everyone about a weakness before it can be solved would harm users, but disclosure and resolution is the goal you're working towards. Saving face would be a gag agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action

The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore