It's a real problem in a lot of industries.
If I were a hacker I would hold off on exploiting any recently discovered vulnerabilities. Why tip my hand and release a virus or trojan that MS will patch against, when I can just stockpile them for a couple months?
I agree with you completely.