I don't think you should out them publicly. Are you interested in having them improve their security model [1] or do you want to have what they have they done out in the open so that others can try to social engineer them and their customers might suffer the consequences?
[1] If so, tell them about this in a way that will get their attention without causing their customers or them any harm.
[1] If so, tell them about this in a way that will get their attention without causing their customers or them any harm.