You say that as if being harangued is the worst thing that could happen to a company.

Plus, were this the case, the CSV list would have stunted vulnerability exploration across the board. Have you seen the list of vulnerabilities discovered in curl?