A security issue is a security issue, regardless of how severe it is. If MS had come out and said "We're working on fixing it, but we don't think it's a critic

A security issue is a security issue, regardless of how severe it is. If MS had come out and said "We're working on fixing it, but we don't think it's a critical vulnerability" - that would be understandable. What needs to be called out is if they come and say "This isn't an issue at all". If some website was leaking password hashes, would "well the hashes are so strong that this isn't really an issue" be an acceptable response?