The article says "Ormandy said protocol handlers are a popular source of vulnerabilities and argued that 'hcp://' itself has been the target of attacks multiple times in the past."

I'm not defending his actions, but I think he's arguing that it's likely that black-hats already know about the vulnerability because it occurs in a heavily targeted attack vector. Therefor, releasing details gives IT professionals the knowledge they need to setup firewalls or do whatever they have to do to protect against the vulnerability while waiting for an official patch from Microsoft.

With that said, perhaps there's a better way to accomplish that goal.