From what I saw, the problem wasn't response time but response tone.
If he'd said "I'll write my own solution" rather than calling it boring, his response wouldn't have been a problem.
Expecting a reasonably-quick response to security concerns is certainly appropriate.
In a free project where the author isn't paid? What if he's on vacation? What's the SLA there? Is it reasonable to expect him to cut short the vacation?
If you want to be able to place expectations on the author, pay them and get a contract.
Then it is about communicating exactly this. Security and trust hinge on properly communicating what is going on.
That's like expecting your boss to double your salary because he is paying you salary. Opensource expectation should be in general if you are not happy feel free to fork and fix yourself. Then submit PR if you want to push your fix upstream.
But still so many PRs getting rejected, because they do not pass code review and usually it does not cause reporters of those failed PRs to open whole big flame discussion. That + overreaction on reddit was a last drop after which Nikolay decided to close the thing.
I'm not sure combining social media with code control is going to be such a good thing for a lot of developers who might not like to program in a fishbowl.