This is just some rationalization that security nerds like to regurgitate on each other.
Unjustified empirical claim.
And even if it were true, it would still be insufficient for justifying public disclosure, classic is-ought.
Also, only nerds stand up for security nerds.