This goes both ways. The wisest action for the next guy who digs up an exploit is to release it anonymously.