Disclosing a vulnerability immediately after it is discovered has a few problems. One is a risk to the customers, as script kiddies will create git repos full of tools to automation exploitation of the vulnerability. Another risk is that people will jump to conclusions without a proper root cause analysis being performed that determines how this happened, what is required to prevent it from happening and if there may be more aspects to this vulnerability than was were originally thought to exist. Another reason to not disclose immediately would be that in most cases it will violate the agreement the penetration tester or security researcher has with the bug bounty program. Disclosing immediately would mean they do not get paid for their discovery. This payment for bugs concept provides an incentive for people to help a company fix their bugs that their own developers and QA teams may have overlooked.