“Experts said public companies worry about the loss of customer confidence and the legal liability to shareholders or security vendors when they report flaws.”