Why are you creating a hypothetical situation about security? Seems like a hypothetical situation about customer support would be more appropriate. The answer is (for customer support)-- moderately. But the question is: What's the goal with a response? To make them suffer? Or to fix it? How does it benefit my business to invest extra time/money to make another company suffer?
I think the grown up / smart way to respond to feeling pissed off/slighted isn't what 37s did. And it's not calling a lawyer. Or not at first.
If it was important to my business that the issue fix itself, I'd way the costs and benefits of assorted actions. Easiest thing is to pick up the phone and take 15 minutes to politely explain our position and ask for a timeframe for resolution. If didn't feel that was going to solve the issue, I'd go the expose' route (which, as someone else mentioned-- carries a lot more weight if you can say, "I privately asked them to fix it and they pretty much told me to fuck off"). If that didn't work, I'd decide whether it was worth the $300 to spin up a form letter from my lawyer. And if that didn't work, I'd decide whether it was worth it to spin up a lawsuit (in terms of time and money).
Being "pissed off" shouldn't enter into business decisions. But, again-- I don't think 37s' decision to take this public immediately was not motivated by anything but self-gratification (unless you want to go meta and credit them for a great linkbait play).