Do they accept invoices for patching their security flaws?
Are they liable?
That presumably depends on your tolerance for bureaucracy and pain.