As I see it he is not the one exposing clients to risk. He is frustrated that no one is fixing it. The company that left themselves open like this are the ones that are exposing their clients.

If this person is doing his best to do the right thing, there are probably other people who know about this vulnerability and are using it without telling anyone.