I would like to give my opinions on the three points you have stated.

> Single-vulnerability questions should be closed as Too Localized, unless they're high profile and warrant a decent writeup on the subject.

I do not agree with this, coming from personal experiences.

[Understanding a vulnerability][1]

This is my first question on Sec.SE. I was searching high and low for information on this particular vulnerability in the CVD and other similar databases. However, what I could find was either too vague, or too in-depth for someone of my experience.

I asked the question here and learnt plenty from the answer provided. The answerer was you no less. ;) This was what prompted me to stick around.

Going by your guidelines, I would have closed that question. Although it is a chrome vulnerability, it isn't particularly high profile. I don't think that is a good idea.

What we can do is enforce naming guidelines on the questions, which will provide the CVE number and other minor details. This would make searching for a information on a particular vulnerability easier.

> Knowledge is inherently amoral. What's done with it is outside our jurisdiction. However, in cases where malintent is shown, we should close the question.

I agree with this. Questions asking for explanations or clarifications about a particular vulnerability should be allowed. However, questions like "give me the exploit code for this vulnerability pl0x" should be closed immediately. 

> Generic advice is useful to lots of people, but less useful to the asker. We'd have to judge this on a case-by-case basis. Should we have a line in the sand, or should we leave it up to the answerer to judge?

I don't think it is possible to provide a guideline for this. It will vary from question to question. The answerer should decide on what to cover. Upvotes and downvotes by the community will do the rest.

  [1]: https://security.stackexchange.com/questions/15436/understanding-a-vulnerability