Responsible disclosure is about harm minimization. If you tell the world about an exploit, now there are thousands of hackers who have been informed about ways they can harm innocent people.
You should only openly disclose a found vulnerability if there's a good chance its already being widely used.
But, lead in a food product? You aren't protecting innocent people by hiding the culprit. You don't have thousands of hackers who are going to run around spiking peoples drinks with lead contaminated protein powder.
No excuses for this behavior. If you find lead in a product people are ingesting, you need to tell the world all of the details. Otherwise you are a bad actor.
You should only openly disclose a found vulnerability if there's a good chance its already being widely used.
But, lead in a food product? You aren't protecting innocent people by hiding the culprit. You don't have thousands of hackers who are going to run around spiking peoples drinks with lead contaminated protein powder.
No excuses for this behavior. If you find lead in a product people are ingesting, you need to tell the world all of the details. Otherwise you are a bad actor.