> I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies.

Is this view particular to software defects? For example, do government inspectors have an obligation to report food safety violations that they've discovered? In either case, the problem puts the public at risk.