This isn't a matter of transparency, was the OP legally bound not to disclose the RCE? That whole "embargo" was pure courtesy between the people involved. The OP committed no fault at first place and the exploit was already in the wild anyway. Whoever really wanted to exploit it before the patch could without using the OP as a source.

> Anyone can sue anyone else for any reason.

And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.

While possibly true in theory, in practice it's not. Courts and judges do not take kindly to frivolous or unsubstantiated claims, and any halfway good attorney would advise you to not waste your money and your time on a claim you are unlikely to win or be able to collect on.

People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.