The legal question here is an interesting one. Should companies have to disclose unpatched security vulnerabilities that might affect share price or keep them secret so as to cause a, ha-ha, meltdown?
General sanity suggests the latter, but as we all know, courts are not always sane...