In this particular case, I disagree.
Responsible disclosure to blockstream security could have resulted in a stop of liquid block production, and therefore not put any user's funds at risk.
If they did report it and Blockstream did nothing, then the right move is to take the money.
