I don't believe it is extortion since all he is asking them to do is fix their own vulnerability. I believe extortion requires the demand of money or services in exchange for action/inaction.
You can currently set your Google profile to not be publicly indexed by search engines under "search visibility" on the edit page, but don't know if it will carry over once + goes public.