That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.
Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance.
This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).