Personally i'm still not convinced this is good or bad.

Protect users AND educating script kiddies, this is a hard trade off, and all lazy updating users will be more vulnerable then before.

(more being more script kiddies, not so much more vulnerabilities).

As long as it is done responsible and vendors are given chances to fix this before. Not disclosing is worse i guess in any case.

However, "We encourage users to verify that auto-updaters have already updated Flash"

While adobe recommends to not install it, meh.. :)