I worked with MSRC several times over the years and found them to be smart security professionals (and often former hackers) who care deeply about improving security.

I suggest you take the long view and compare how Microsoft handled security disclosures in the past ("That vulnerability is entirely theoretical.") compared with today (inviting hackers to their oncampus Bluehat conference, sponsoring CanSecWest, etc). Things could always get better, but they've come a long way.

More specifically, "only" 2 weeks to issue a security fix is actually pretty good for thick client/desktop software. It's less than ideal for something like a web app where they control all the machines that need to adopt the fix, but still. Also, the severity of reported issue is a factor in when something gets fixed.

Consider looking at something like rfp's RFPolicy if you'd like guidance on how to disclose in a reasonable, timely way