If you really wanted to attack their vuln-investigation processes, you would simply let them conduct business as usual since it seems they don't know how to triage potential vulnerabilities. If you force the issue by conducting a DDoS, they will respond by developing a better triage system that de-prioritizes crank vuln reports more quickly. Not only will this defeat your DDoS attempt, but it will make them more effective at handling vuln reports going forward.