You might think security teams inside big companies hate it when researchers and the press point out vulnerabilities, but that’s not always the case.