Feels just a little entitled. For the longest time hackers would notice an issue on a service they used, and out of respect for the service and concern for their own data, they would report. Threats of legal action would quickly follow, so hackers stopped reporting.

Now a lot of the major players have policies promising no legal action for responsible disclosure, some even have rewards (whether monetary or acknowledgement) for the hackers.

In this case, a response was given, no legal action was threatened, and the bug was quickly fixed. Isn't this the goal? Looks like Yahoo is doing their job here.