As having personally worked to tell the IE team about a severe bug (crashie.com), I can tell you that their process, community and bureaucracy are by far the worst part of Internet Explorer. You'll get ignored, told that the problem is with your code, mocked in the forums, and then ultimately told the problem isn't a big enough deal (or in my case, too complicated) to fix.

The only way to get the IE team to fix issues is make a public spectacle like Vupen did. And I completely get only exposing bugs when there is a profit to be made, because any other route is counterproductive.