I don't think its the job of Security Researchers to defend a OEMs customers. That's the OEMs job? If the OEM does not want to protect its customers after a res

I don't think its the job of Security Researchers to defend a OEMs customers. That's the OEMs job? If the OEM does not want to protect its customers after a research has literally given the vulnerability to them its no longer on the researcher. In fact its probably bad ethics for the researcher not to publish because just because there is no report does not mean the bug is not exploited or known by malicious actors. The researchers last recourse is to publish a notification to let the OEMs customers there is an issue since the OEM won't acknowledge it.