Frankly, it doesn't matter whether they do or not, because if a vulnerability is known and there are exploits for it in the wild, then hackers are simply going to try to exploit it, not check /heartbleed.txt.
Aside from all that, sites who don't have the courage to list their unpatched vulnerabilities can simply only list the ones that are already patched.
Comments
So sites ought to list their unpatched vulnerabilities? Erm?
Well, yes, frankly, they should. ;-)
Frankly, it doesn't matter whether they do or not, because if a vulnerability is known and there are exploits for it in the wild, then hackers are simply going to try to exploit it, not check /heartbleed.txt.
Aside from all that, sites who don't have the courage to list their unpatched vulnerabilities can simply only list the ones that are already patched.