When vendors send cease & desist warnings just before they know a disclosure is to be made, it causes an interesting dilemma: if you think a vendor will resort to such tactics, do you simply not inform them of the impending release? Thoughts welcome. 
One strike policy. If they attempt to do this once, they forfeit the right to advance disclosure of any future vulnerabilities. This fact and the C&D should be documented for that vendor's customers to reference.
