There are lots of possible choices, but if you depend on software not available on other platforms, it doesn't matter. If Microsoft doesn't do their job once properly notified, they deserve a slap on the wrist.
Edit: missing clarity - I think fines are appropriate when/if damage occurs, my reply was based on if notification happens without actively being exploited.