If you read they are going to begin publicly announcing when a new exploit has been identified as an exploit and punishing anyone that uses it after they confirm it but before it is patched, not people who found it before they announced it was flagged as an exploit.