bad take and fundentally incorrect assesment and fixing take time, rollouts even longer, if the bug is protocol level all clients and mints would need to patch before disclosure. Sure the 'fix' in this process may be immediate but the rollout and post-patch assessment is very important and takes time. immediate disclosure benfits only skriptkiddies and malicious actors. These aren't new ideas, we stand on the shoulders of cybersecurity wizards and years of research on how to best innoculate a in-production coding project from bugs and potential exploits.