That seems like a rather specific guess -- plenty of things can go wrong beside that problem. I found the comment more reflective of lacking any reporting proc

That seems like a rather specific guess -- plenty of things can go wrong beside that problem. I found the comment more reflective of lacking any reporting process, even for "major" vulnerabilities. These days, companies have turned bug bounties into a marketing and recruiting tool, so it's a very different story.