I see nothing wrong with preventing the publication of the exploits UNTIL they are resolved. If the company responsible for the security system does not want to resolve the security vulnerability, then they should be published.

Even though this scientist first discovered the vulnerability, it doesn't mean that someone else won't do so in the near future.