I would like to give my opinions on the three points you have stated.
Single-vulnerability questions should be closed as Too Localized, unless they're high profile and warrant a decent writeup on the subject.
I do not agree with this, coming from personal experiences.
Understanding a vulnerabilityUnderstanding a vulnerability
This is my first question on Sec.SE. I was searching high and low for information on this particular vulnerability in the CVD and other similar databases. However, what I could find was either too vague, or too in-depth for someone of my experience.
I asked the question here and learnt plenty from the answer provided. The answerer was you no less. ;) This was what prompted me to stick around.
Going by your guidelines, I would have closed that question. Although it is a chrome vulnerability, it isn't particularly high profile. I don't think that is a good idea.
What we can do is enforce naming guidelines on the questions, which will provide the CVE number and other minor details. This would make searching for a information on a particular vulnerability easier.
Knowledge is inherently amoral. What's done with it is outside our jurisdiction. However, in cases where malintent is shown, we should close the question.
I agree with this. Questions asking for explanations or clarifications about a particular vulnerability should be allowed. However, questions like "give me the exploit code for this vulnerability pl0x" should be closed immediately.
Generic advice is useful to lots of people, but less useful to the asker. We'd have to judge this on a case-by-case basis. Should we have a line in the sand, or should we leave it up to the answerer to judge?
I don't think it is possible to provide a guideline for this. It will vary from question to question. The answerer should decide on what to cover. Upvotes and downvotes by the community will do the rest.