Someone who writes a response to a security vulnerability report, includes nobody else in the discussion, then leaves for vacation within 15 minutes of sending that report is irresponsible. Giving someone a week to respond is not unreasonable. If nobody responds in a week, it can safely be assumed that they don't take security seriously, and the responsible thing is to let the community know.
Spin it how you like, but the "we're too important to respond" shtick is old and tired.
Spin it how you like, but the "we're too important to respond" shtick is old and tired.