A good way of determining how seriously an organization takes security is to look for any kind of security incident report page or security contact info. Bonus points for publishing a GPG key for the security account. Pretend you have a found a security issue in their system and look for how to they want that reported.

Also. Unresponsive companies like this contribute to the volume of people who don't bother with responsible disclosure and just go straight to full disclosure, anonymously or not.

Companies need to see a hit on their bottom line or a breach in their own security before they take it seriously, as has been demonstrated time and again.