In which case—if it’s a legitimate deficiency—that doesn’t bode well at all for any other commercial enterprise. This arms race is always tilted in favor of the attacker.

There are much smaller companies which handle security disclosures much better.

but there are many many many more that don't, which impeaches the few that don't. The fact that I can reach the CEO of my local small business on the phone is a great when they're sympathetic to my plight. it's actually to the company's detriment when it turns out they're a raging asshole.

I remember some of early Android phones that ran manufacturer maintained Kernel turning out immune to then-undisclosed RCEs years before disclosure.

I think it’s less about disclosure handling but more about being motivated to pay for or build a black magic code analysis tools.

got any links? that sounds like a fascinating story to read!