I'm not saying he should not publish this at all. I just think it will be more responsible to try to work with the vendor. Right now he has not even made that effort.
And he hasn't released the source code and hardware specs yet. So, although I think he should have contacted the vendor (even if that could have been inconvenient for him) before going public, he still hasn't made it trivial for a third party to go around robbing unattended hotel rooms. It's his choice but I would appeal to him to not do that.
Full disclosure is a lot of fun, and it increases the status of geeks like us, so it's really to approve of it. I did when I was in college.
