I know nothing about the product they are selling. As an engineer, I think writing a critical blog post after giving just a 1.5 day notice is bad behavior.
Your outrage sounds disingenuous. 1.5 days is definitely not a reasonable timeframe for a response to a partially resolved issue. What is 1.5 days in this context? Friday afternoon and Monday? Do you and their security engineers even live in the same time zone?