Unless they released it maliciously, I don't hold it against them. And wouldn't call anyone a dick unless they planned to do something evil.

Exceptions: issue was known but got ignored due to release schedule, or security was never mentioned in the project and at no level was there any security consideration. But that's for specific management issues, not engineers or the vendor in general.

That's an incredibly low bar. All you have to do to meet is is not actively look for security vulnerabilities in your products.