[jamespo]

Worse than that, they may just post the vulnerabilities publicly or sell them on Black Hat forums.