Exposing expoits prior to letting the vulnerable party know is a pretty poor way to go about things, but at what point should legal action be taken against VTec

Exposing expoits prior to letting the vulnerable party know is a pretty poor way to go about things, but at what point should legal action be taken against VTech for not properly securing this info?