tldr: if security issues don’t get disclosed (or the real threat of disclosure) they won’t get fixed / prioritized.