> If you find a vuln, you might as well disclose to everyone immediately.

This still doesn't work, since attackers are much more motivated and able to pay attention to such things.

If your goal is finding vulnerabilities / stealing money / whatever, you focus all your energy looking for new exploits.

The rest of the world has other things to do (listen to users, run services, whatever) and by definition cannot spend as much of their time watching every social media in the world for the chance of an announcement.

That's why anyone who has a lot to lose from a data breach had better either harden the shell of their system such that it's not vulnerable (very hard to do correctly) or automate the process of listening for and reacting to vulns.