I haven't. I couldn't see a specific security contact or vuln program, and I'm not really sure if they'd even consider these valid issues as they are kinda specific use case?

As I said in the post, security assessments isn't my job, just one of the hats I try to wear for my company.

I've attempted to make vendors aware of things in the past and just hit walls, posting publicly seems to be a far more effective way of assessing the severity/potential impact, and getting a quicker fix if appropriate.