He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.