The way I see it, as long as you do your job to notify them of security problems with their code, then the ball is in their court and it's out of your hands. If they choose to ignore it, and it ends up being a disaster, it's their fault as long as you can show you did your job in notifying them properly.

Enjoy dat paycheck. You're earning it.