There is another reason why responsible disclosure would have been better (and less short-sighted): vendor might make an internal audit, find root cause and invalidate a bunch of certificates at once (think about similarly leaked certificates due to a bug in some deployment tool).

Now it's an open race with the bad guys, and surely a lot of them all at once; hardly an advantageous scenario for end users.