Given that the OpenSSL team has slacked massively on setting up an advanced notification list, would you consider notifying distributions privately the next time you received word of something of this magnitude?
The bigger question, though, is how much trust you can have with the kind of people who would zero-day most of the internet for a marketing exercise. Discrete notifications would have closed the vulnerability window for a lot of people (think e.g. stealthy AWS, Rackspace, etc. upgrades) and it's not clear to me that Codenomicon is likely to produce future tips of such value as to outweigh that.