What's the thinking there about the pros and cons? Specifically, is there any concern that this might help people who would exploit vulnerabilities rather than fix them?
One big reason is that the alternative to this structured data being open source is that it lives in proprietary databases. In that world, attackers still have knowledge about these vulnerabilities - they don't need the structured data as much as defenders, and the licenses on those proprietary databases aren't going to deter them anyway (most are public for SEO reasons). Defenders on the other hand, often won't have as much or as high quality information.
The world is safer with this info in the public domain, will there be new exploits based on additional info? Sure, but that will get mitigated.
Software, like law or medicine is a practice, meaning we aren’t experts... we’re just learning better ways to do things.
This just opens the world to formal verification... for goodness sakes we’re just getting to fully reproducible deterministic software builds.
EDIT: Although your concerns might apply to unconfirmed public PRs