The severity of the problem was pretty clearly and concisely conveyed: "This is a very bad bug, and you should fix it ASAP. Don't wait."

As for how many people it practically affects, that could well hurt. Saying anything more than "Applications are broadly vulnerable to this problem." like he did elsewhere in this thread could very well point out specific, detectable vulnerable instances. That's a bad thing. Just wait and more info will be out, but heed his advice!