I suspect that some plugin authors prefer to avoid the perceived negative PR that comes from stating that their plugins were vulnerable. However, many are sure to be caught out in the long run when site owners don't bother to update their sites because they have not realised the risk.