If you know how the API is broken, what about an article here? Write this up, don't mention the company, or use their API, but show how a similar API scheme or implementation, is broken.

I bet you'd get lots of good supporting comments that might worry the company.