Only by casual hackers. The pros will probably have been exploiting the flaw for weeks or months against gainful targets.

If there is a reasonable end-user workaround against the vulnerability then I'd argue it's more responsible to publish early and widely than to wait for the vendor.

It becomes greyer if there is no workaround. I'm not sure what I'd support in that case.