This was the same with Superfish. If you look at the Lenovo forums and other websites (Google search Superfish and set the time to before 2015) you'd find tons

This was the same with Superfish. If you look at the Lenovo forums and other websites (Google search Superfish and set the time to before 2015) you'd find tons of complaints from users. In these instances it was only when somebody recognized these issues as being real security issues and repackaged them that they got the attention they deserved. It is a strange reverse problem in the security world - issues only get treated seriously when they are reported by security people through a formal vulnerability reporting and disclosure program (or informally via full-disclosure and other lists/forums). While Google and other companies take security reports through these formal channels very seriously, I doubt they have anybody dedicated to trawling through user feedback and forums and spotting anything that might be infosec related.