[geofft]

It is unprofessional and bad business to deliberately sell your customers insecure code, and you should not expect anyone to support you in doing so. Jason would have veen within his rights to warn Netgate's customers about security holes in pfSense - but he didn't even do that, he made a comment on his own project's mailing list, intentionally not naming the company, about what he was doing and why, which is entirely within the realm of "professional."

(And there is, of course, the question of whether Netgate is in any way "professional" by building on top of an open project and not following its norms.)