I think this is different from the usual situation where somebody finds a vulnerability and goes to the vendor to see if they'll patch it instead of immediately going public. He found that they were apparently deliberately misleading consumers about how they were handling their data, in a way that easily may have lead to users trusting them with data that they might not have if they'd been upfront about their key management. I think an FTC complaint is entirely justified.

You're definitely correct about him being a PR seeker. I'm not too familiar with this fellow, so if he is slagging off PR people it would certainly be hypocritical, but so what? I think this guy is providing a valuable service by exposing misconduct by tech companies.