Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-w

Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-waster/spammer and in that sense, it's easier for the company to take his approach seriously than if he'd sent a random email in to sales@. Had the company done the right thing and taken him seriously, it would have led to a faster escalation on that basis. He could have immediately emailed the issue and the company would know to expect it and who they're dealing with.