That was true when the incentive was for vulnerabilities to be disclosed and fixed for the good of all, but sadly today, vulnerabilities are extremely valuable and so the incentive is for them to be sold to the powerful.