He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to [email protected] and not [email protected] and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.