A normal process goes like this:

- Researcher finds bug

- Researcher discloses to vendor

- Vendor fixes (or not)

- Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first)

This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited.

It's very naive to assume that bugs can be fixed before others can exploit them. Bugs take time to fix, and the process takes time, especially when dealing with large enterprises.