When a researcher went public with Microsoft vulnerabilities, it laid bare a conflict that has never really been solved.