Oh wow...I think I disagree with everything in this comment.

If you can't monitor critical bug notifications and can't fix or provide a compensating control, you should not be in security.

I hope all affected parties are able to sue them.