Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the act

Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.