Rapid7's article on the topic[1] mostly focuses on the need for providing enough information to IT admins so they can understand the severity of the problem. There are other unsaid reasons for this (credit/payment I'd imagine is part of it), but on face value doesn't this make sense? When Metabase[2] says "Upgrade your instance NOW" and they have a vuln that "allows unprivileged access to any Metabase instance" I upgraded immediately. When JetBrains[3] says "4 security problems have been fixed. We highly recommend installing this update as it includes a fix for a critical security vulnerability" then many people are not going to upgrade as quickly. Jetbrains eventually gave more information[4] but would they have done this if Rapid7 wasn't threatening to disclose it themselves?

^1: https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-...

^2: https://discourse.metabase.com/t/upgrade-your-metabase-insta...

^3: https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-r...

^4: https://blog.jetbrains.com/teamcity/2024/03/additional-criti...