[anonymousab]

Moreso, at some point it may be more responsible to exert real pressure and a time concern on them to fix it by revealing the flaw.

It depends on whether you think there's a reasonable chance that someone may be using that exploit by now. Carrot and stick approaches do not work without a reliable stick.

Edit: I suppose it also depends on how much you value going through the exact same process with valve for other bugs in the future. But in a situation like this it seems like little would be lost.