Just like trying to report a security vulnerability to a company in good faith, you are often better off just publishing it anonymously even if it is worse for the company.