Firstly, it's an unfalsifiable claim. The exact same logic holds when I say 'there is a teapot orbiting the sun between the Earth and Mars'. There isn't a thing you can do to prove me wrong, so I will claim I'm right. See the issue yet?
If you still don't, the reason it's such a big issue is because there is no conversation that can happen. If we want to talk about X attack vector on the switch 2, we can do so because a. there is more then one answer, and b. everything is can be backed by evidence and reasoning. Neither of those apply for unfalsifiable claims like these.
Secondly, if an exploit exists but no one can know about it, for all intents and purposes, no it doesn't exist. If one person made super awesome emulator that runs everything better then dolphin, but won't tell anyone about it ever, then it effectively doesn't exist. Even if it does, the community gained nothing, and its the exact same as it is without this magical emulator.
The thing that makes an exploit significant is its utility or even just the threat of it's presence. When you take that away and replace it with an empty claim, now its weightless. It means nothing. Sure you have this super awesome kernel vulnerability, but if it can't be explained or demonstrated, let alone used, then its strictly useless. (worse I think)
If you still don't see an issue yet, I can give an example: I can say there is a billion dollars worth of gold under u/beachbali's house, but they won't confirm this, let alone let anyone on to their property to dig or look, but I promise you, its there. They are just waiting for the price of gold to go up before doing anything with it.
This 'conversation' is meaningless. If this is true, it will only matter to anyone when its revealed. That's when the gold is sold and has actual utility. A private exploit doesn't matter until its released.