OpenSSL could make the same argument about the original tweet that in essence was a threat against the security of the application done publicly without any thought of engaging the organization.

This is like hackers who compromise servers and then post sensitive account details publicly to harm the organization that was compromised. The original tweet did the same thing since he clearly hasn't take any steps to notify the organization about the exploit.