They sure are valuable, he never said otherwise. His point was that the PoC exploit was released before or right at the time that patches became available and delaying the exploit PoC would give people a bit time to patch their systems.
One choice puts a lot of risk on the users of software. One choice puts way less. You're constantly encouraging putting more risk on users and exploits into arbitrary attackers' hands with the argument that one or more attackers might already be a risk. That makes no sense. The only people with a straight-up benefit from this are malware writers who don't want to work very hard converting the patch into an exploit.
Researchers should delay the publishing of exploits at least a week so people can test and deploy the patch. I keep mentioning testing because patches sometimes break stuff themselves. Doing otherwise just saves attackers work.
Instead, you want to acquire immediate vulnerability to a large group of hackers to prevent a patch from maybe making you vulnerable to a smaller number that either has an existing exploit or RE'd the non-working patch to devise a new one. Makes no sense lol... Better to get the patch, do basic tests to ensure it doesn't break functionality, install it, monitor the system/network, and then verify the security later when the sploit is released.
What they did here was simply irresponsible at best.
If you want to get rid of the False Sense Of Security, announce that there are working exploits out there.
This also prevents users from being able to test their machines vulnerability after patching to verify that the patch remedies the problem in their installation. Again, apply the patch, hope that it works in my installation (with my config options) is a piss poor security policy.
This assumes a bunch of stuff about the psychology of everyone else that you cannot possibly know.
You are making decisions for other people because you think you know their business better than they actually do.
> This is a sense of security
You are not a telepath who can read people's minds.
1) It helps admins verify that the patch was successfully applied.
2) It gives security researchers more surface area to evaluate when looking for similar bugs or bugs in the patch.
I'm not asserting that there are not negative aspects, but in the majority of cases waiting for some indeterminate time before releasing a PoC or not releasing one at all is net negative.