Why would they wait to patch a massive vulnerability in their site that's just waiting to shower them in negative press?

not sure, but they just lost a customer.

My annual sub end March 1st which is about perfect timing since they were trying to double the annual rate without proper notice, in my opinion.