Every single time. They don't really care about users, their safety and privacy. They care about legal liability and not looking foolish in public. It seriously makes me wish people would just publish vulnerabilities straight up complete with exploit source code so they'd have literally no choice but to care.
It seems far more likely that they didn’t understand the email from Troy or dismissed it as spam or a scam.
They took notice because a bunch of their regulars started getting emails from HIBP. Some of these did understand, and brought the issue to the attention of the admins admins in a way they understood.
That's what happens when there are too many who "cry wolf"; and bug-bounty programs just incentivise that behaviour.
It is incredibly hard to prove someone else knew about something you didn’t/don’t know about though.
If anything, my conclusion is that security researchers shouldn’t have any qualms about releasing vuln info. By all means, give the concerned party an opportunity to act in good faith, but when they invariably don’t, send it..