This is probably a fairly hot take but I believe that researchers shoudn't normanize providing this level of detail unless they have been explicitly hired to do so.

The industry is pretty messed up and it sometimes feels like researchers/pen testers/bug hunters are effectively subsidizing and protecting shitty security practises.