Given how security moguls are handling that, we should go back to "just release it, consequences be damned". Coz that gets normal people better chance of actually fixing it
But normal people don't matter to security researchers, only big companies that might throw them a dime.