How would you inform the general public of the severity of the problem?! "Hey they have an SQLI vulnerability! I own them!" or "Hey I just downloaded millions of records including the photo's you took". See the difference? I agree with your point, but that approach doesn't translate the severity of the problem to the public. I don't have the solution to this problem, except perhaps educating the general public?!