He hasn't even gone to the point of no return yet. The vendor's competitors -- assuming they aren't similarly vulnerable -- can point this news article out in their marketing literature.

The company can probably come up with a solution faster than a brand new third party can generate all of this guy's work.