But the privacy of a security disclosure shouldn't just be based on the company responsible for it. It should also take into account the fact that users of that company's product could be harmed by a public disclosure.

In this case I think the public disclosure would have two effects: 1. Put current users of the product at risk. 2. Prevent people from signing up for the product.

So the question really becomes, does 1 outweigh 2, or vice-versa? (and the answer to that also depends on how cooperative & quick the company will be with a fix)