I mean, following proper disclosure procedure requires giving the manufacturer adequate time to patch the vulnerabilities before they are released. Would you prefer they just publish the full how-to right up front, and create a zero-day for anyone (from script kiddies to state-sponsored hackers) to use as they see fit?