It ought to be criminal, the way it's approaching a found security flaw. The sort of review shenanigans they're pulling should be criminal as well.

Company is revealed to be completely incompetent with regards to security. So their reaction is to harangue and pressure the reviewer instead of fixing the problem.