Surely no vulnerabilities should be disclosed to the US government earlier than the public because it does abuse them to hack people's computers, and it doesn't make its own systems that would need protecting any more than private companies do. It's like giving a hacker group advanced notification.

Imagine the roles being reversed. Would we care if a Chinese chip maker notified Google before the Chinese government? I'm sure nobody on HN would be complaining. That makes it look like naive American-centrism.