When someone submits a patch for a vulnerability label the commit with that information.

> You have to rush to patch in any case.

The difference is how much of a head start attackers have. Attackers are incentivized to read commits for obfuscated vulns - asking defenders to do that is just adding one more thing to our plates.

That's a huge difference.

> the logical step is that it doesn't require immediate action when the label is not there.

So I can go about my patch cycle as normal.

> Never mind that the bug might actually be exploitable but undiscovered by white hats.

OK? So? First of all, it's usually really obvious when a bug might be exploitable, or at least it would be if we didn't have commits obfuscating the details. Second, I'm not suggesting that you only apply security labeled patches.