I understand exactly why they do it. And it’s jackassery. If Microsoft had not done anything then I’d fully support responsible disclosure. But Microsoft did issue a patch which did fix the originally reported issue. It’s not clear that the second exploit path was called out in the initial project zero report. IMHO the fact that the vendor is responsive and working on the issue means that publishing exploit code puts millions of users at additional risk with no tangible security benefit. And yes, I am a career IT security professional. Project Zero is a good idea in general; in this case disclosure was irresponsible IMO.