> companies want to use responsible disclosure as a mechanism so it can save face and their reputation

That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it

The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore