'Security by obscurity' is deprecated because obscurity alone does not lead to security. This in no way promotes, endorses or justifies irresponsible disclosure.
"Responsible disclosure" is a buzzword made up by companies to bully security researchers into keeping quiet about vulnerabilities for months. If the OP is unable to contact the maintainer because they are missing it would be irresponsible to keep quiet about the bug.
Responsible disclosure is a valid concept that some companies attempt to abuse. In the scenario you propose here, I would probably contact CMU's CERT division.
Non-disclosure continues to allow security issues to slide by. Companies need to know security is their absolute #1 priority to the extent that it will damage the business every time one of these issues is exposed. Today they have no incentive to fix issues and prevent future ones as the exposure is minimized.