It's one thing to expect companies to act on their own initiative, but to do nothing when the problem is proactively reported to them borders on negligence.
If CF start to do that, then this is where it starts to look a lot like the legal process, so why reinvent something that already exists?