It is normal, but not desirable. You should feel free to exercise full disclosure if the vendor is not being responsible.

> [W]ithout the threat of full disclosure, responsible disclosure would not work, and vendors would go back to ignoring security vulnerabilities.

https://www.schneier.com/blog/archives/2012/06/on_securing_p...