It is not the same to assume that someone is using a breach somewhere in a system with shared responsibilities among companies, and use resources to find it, or, when someone bring you all the details of a proven vulnerability, is ready to show it to the world, and then decide to not do anything...