Maybe I'm just cynical, but it seems like working behind the scenes with the vendor doesn't seem to bear fruit very often. It's pretty frequent to read about companies that have ignored vulnerabilities until they're fully disclosed. Plus, AT&T doesn't exactly have a recent track record for keeping their network or services in good order.

Of course, the vulnerabilities that are fixed by working directly with vendors never end up the topic of news articles, so I'm sure it's not as cut and dry as an outside perspective would indicate.