I don't think you should out them publicly. Are you interested in having them improve their security model [1] or do you want to have what they have they done out in the open so that others can try to social engineer them and their customers might suffer the consequences?

[1] If so, tell them about this in a way that will get their attention without causing their customers or them any harm.

You're correct. I'll contact them.

Always have a reasonable response deadline. For a security issue, above 1 month is unreasonable for a small deployment, above 3 months in a huge deployment in my opinion.