Apple's entire bug reporting system has always been massively dysfunctional. It is little surprise this extends to their handling of externally reported security issues as well.