A potential security hole is very different from someone being locked out of their account (as annoying as that is). Most web companies by now have sound procedures in place to quickly escalate those reports.

And yes, realistically, a larger service like CloudFlare is going to get more attention than any individual. It might seem unfair to the individual, but overall, it's in everyone's interest when a situation like this arises.