I think its unreasonable to expect reporters to do anything other than report the bug. Its not their software.

General industry practise (or at least google) is to wait 90 days of being ignored before trying something else. And google got hugely criticized in the beginning for only waiting 90 days. You are suggesting this person should only wait a week before going full disclosure? They would be crucified if they did that.