Would you tell them?
If a well know website is has parts of it which are ridiculously insecure, would you let them know?
I mean, it's not like I can nick all their bank details but I could put some special offers on that really pissed them off. Its almost like a wki..
Not a web developer so I might just be over reacting.