From personal experience it seems relatively common in the embedded-esque software space, although not always quite as sophisticated as seen here.

> Is there some kind of whistleblower law that would allow someone with knowledge to come forward?

Depends on where you live, unfortunately anywhere with 'stong' IP laws you aren't allowed to patch anything. Usually reverse engineering analysis is still fine, although if there is a contract saying you're not allowed to you could be screwed anyway.

In the train case the locks were specifically for anti-competitive purposes, and so they can whistle-blow for that; and I think in the general case you can sue for misleading dealings/false advertising/etc but not for anything specific to the software locks/traps.