Even if they were to path the provided list, it sounds like the problem runs deeper. In that case there's not much you can do unless you're at a higher up position within the actual org.
There's probably nothing you can realistically do (except spread the word, of course). Most pen testing just isn't that sexy. The likely result that will draw in public interest is that eventually they will have a major public security issue. It's that simple, and sometimes it's just a matter of time.
There is a chance that the biggest problems are localized at the interface between the company and public, and in that case getting the higher ups to be aware of the severity of the deficiency (both culturally and technically) could change things, but it's likely you're going to find the same thing when you climb the ladder...