I thought he was extremely nice to wait that long. That's 72 hours more than these abusive corporations deserve. I actually wish these people would just publish these vulnerabilities out of nowhere to force them to deal with it or go bankrupt from liability. Any damage caused by such "reckless" disclosures isn't severe enough punishment for their surveillance capitalism business even existing in the first place. There should have been no data to be compromised in the first place.