> If you find a vuln, you might as well disclose to everyone immediately.

This still doesn't work, since attackers are much more motivated and able to pay attention to such things.

If your goal is finding vulnerabilities / stealing money / whatever, you focus all your energy looking for new exploits.

The rest of the world has other things to do (listen to users, run services, whatever) and by definition cannot spend as much of their time watching every social media in the world for the chance of an announcement.