Most people not in tech or infosec have never heard of and are totally uneducated about the concept of responsible disclosure. Maybe it needs to be added to high school computer class?
Announcing on Twitter seems more like "hey be careful, make sure your password field is focused."
Its a flaw that needs to be fixed, for sure, but lets not over-exaggerate the severity as an attack surface. Its much, much more likely that it will cause accidental problems when the owner types something (like in the tweet).
> if this bug is real
Why wouldn't it be? Plenty of people here and on twitter are reporting having hit similar issues (with OS X and even linux, so it doesn't seem completely uncommon).
That to me is not the right way to think, but in the day and age where number of likes and followers is king, I'd say it's not too irrational.
I think the cause is more pertinent than the symptom here - Apple don't seem to notice filed bugs unless they blow up on Twitter.