The point made is that "Responsible" implies an ethical obligation to tell a vendor before telling the public.

It's not clear at all that this is reasonable, and IMO, this seems to highlight the lack of incentive (or even perverse incentive) for vendors to secure their systems.