Bruce Schneier is well documented to equate failing to disclose vulnerabilities with making systems less secure, or as he put it in this interview, less safe:
To his credit, he was talking about weakening encryption standards, but then elaborated that simply looking for security vulnerabilities and not telling anyone what they found was also doing that. I find that latter position ridiculous. It would be like saying studying malaria and not reporting your findings makes people less healthy.
https://www.technologyreview.com/s/519336/bruce-schneier-nsa...
To his credit, he was talking about weakening encryption standards, but then elaborated that simply looking for security vulnerabilities and not telling anyone what they found was also doing that. I find that latter position ridiculous. It would be like saying studying malaria and not reporting your findings makes people less healthy.