It really is insane how much you have to tip toe around tech circles just to say anything that isn't part of the colloquial circle jerk.

What you're saying is the approach any competent software company takes to managing vulnerabilities. There's zero reason to write a prior notice that there's a flaw because it would cause panic and allow opportunities to exploit the flaw (((before there's a fix.))) This is the whole premise around 'responsible disclosure' and why every company wants security researchers to abide by it.

The only logical conclusion I can draw here is curls notice is not responsible.