Expecting a reasonably-quick response to security concerns is certainly appropriate.
If you want to be able to place expectations on the author, pay them and get a contract.
But still so many PRs getting rejected, because they do not pass code review and usually it does not cause reporters of those failed PRs to open whole big flame discussion. That + overreaction on reddit was a last drop after which Nikolay decided to close the thing.