I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline before you "go public?" Wouldn't that be something you do later on if it appears that they're just blowing you off and won't do anything about it?

I don't think this applies to the reporter in this case, but it does seem like there's a bit of a trend in security research lately to capitalize on the publicity of finding a vulnerability for one's own personal branding. That feels a bit disingenuous. Not that the appropriate response would be to threaten someone with legal action.