Whatever you want to tell people must not be that important if you can't have a human bother to write it.

The only way I see to disincentivise first to publish is public shaming. Damaging the very reputation they are trying to inflate.

This blog post does well to remind or educate only for everyone else who's interests are actually aligned with public good.

This article (which I only skimmed, since it appears to be clanker-written) seems to completely ignore the new world we're in with security vulnerabilities - once the bug is confirmed, it is easy for many people of moderate skill in the art to rediscover in independently with AI assistance. The work the independent researcher who confirmed it / released an exploit did could have been done by many people - and probably was, including by members of the blackhat community. The fine details of the vulnerability are no longer crown jewels, just some rough details are enough

The joke is "keep undisclosed to give enough time for the maintainer to fix"

Here we are just like having waited for a few years for a fix already...

TL;DR don't tell people something you don't want leaked?