For a software exploit the reason why "responsible disclosure" exists is that once the exploit is known, it can be used against innocent parties running unpatched software. No obvious such impetus exists for faulty or dangerous supplements, and in fact I'd argue it's absolutely the opposite, it would be much more likely to reach the people who are currently being hurt by this if the product SKUs impacted were known.