Even some smaller vulnerabilities are spread through hosting companies pretty quickly within a day or two prior to public release, to give teams time to make sure staff will be ready to patch immediately.

The wider the pre-release news spreads, the more chance you get someone who will spill the beans (intentionally or not).