You're flawed in your response: "Public exposure increases the
visibility, and therefore customersinstall the patches quicker." ...
When someone "full discloses" a vulnerability, there is no patch to
install quicker. This is obvious because there is no patch until either
the vendor releases one, or staff using the product are capable of
creating a work-around. In the case of the SCADA environment, we (again)
are not talking about the potential of a defacement, blue screen, silly
shell, we're talking about sensor, gears and often so much automation
that it would be absurd for a SCADA engineer to "go it alone" and try
create their own patch. Many of these systems don't have the option of
failing or being taken offline. You also state: "Without public
visibility, they will keep running the old code" the reality is, no one
is going to outright replace some of these systems in these
environments. These are not applications and or systems one can plop
onto donated boxes. They have no choice BUT to run the code.