Over the years I've communicated many security bug reports privately to project maintainers and security teams of projects such as OpenSSL, Tor, Python, MITRE. Very pleasant experiences, very kind and thankful and helpful people, so I can't really corroborate this.