Getting penalized - sometimes heavily - for pointing out someone else's security problems can and does happen:

http://thedailywtf.com/Comments/Hack-School.aspx