I also posted to security.apple.com, but they say they typically look at reports "within a week".

Report OE11044088569486, but currently it's just under review and invisible.