I don't think so in this case. The company knew about the feature (per the story they were informed in 2012) so private disclosure would have likely gone nowhe

I don't think so in this case. The company knew about the feature (per the story they were informed in 2012) so private disclosure would have likely gone nowhere. This is another sad example in a long list of security/privacy issues that only gets fixed by what sometimes gets called "stunt hacking" or flashily disclosing the issue. Take android security patching as a great example. Security pros have been lamenting the lack of a security patch process on android for years and years, Samsung et al have done very little about it. Now Stagefright comes along and gets the press and all of a sudden Samsung are committing to regular security patches.. Another good example is the car hacking stuff that Chris Valasek and Charlie Miller did. without the press furory around their release, do we think a recall would've happened for those cars... I don't think so. It's an unfortunate truth in security which is full disclousre gets the results that private disclosure often doesn't.