[Buge]

He tried contacting them 4 different ways. How many ways is he expected to try? He's not being paid for this, he's doing them a favor. It's not his fault McDonalds doesn't have any method for reporting security vulnerabilities. Is he expected to fly down to their headquarters and talk to them in person? At some point you just have to give up. Admittedly yes, he could have waited longer for a call back in this case.

You can't really compare an individual person with Google. Google employees are being paid to do that, so of course they can spend all day trying to contact companies, it's their job to be professional. And they probably have databases of high level security contacts at most companies. And any company will likely take a contact from Google seriously, but possibly blow off a contact by some random guy.