Is it better if

a) some rando watches security fixes being committed to the Linux kernel's git repo, develops exploits within hours of seeing them, and publishes them for everyone to use, or

b) only nation states do that, and they don't share these exploits with anyone

?

Like, for an average computer-using company, obviously (b) is better because nation states are unliekly to target them.

But for the rest of us?