Even when a bug has been fixed in trunk a vendor may not wish to reveal the details of an exploit (either publicly or "just to zed").

A sensitive researcher may not wish their details of their techniques or findings to be revealed to a wider audience.

For context only (I don't want to do the responsible disclosure debate again...) please consider eg recent bugtraq SCADA announcent or Sockstress.