Part of it is because journalism is dead and media generally do not understand cyber security.

Second, if it’s a really good bug, you don’t always want to publish it for free. You’re more likely to sell that information. I think those kinds of bugs tend to get exploited and patched under wraps.