This isn't the mob burning someones shop down. This is more like pointing out, hey dude, your door is open, you should close it.

They don't owe apple anything, and they are not causing the damage (apple's negligence did). If apple doesn't want to handle this in private, they will have to handle this in public. I don't see the problem. Coordinated disclosure is a courtesy, not a rule.