In the US this is protected speech. There is a flaw in published software such that x and y... This is a statement of observed fact no matter how obscure.
Poor form, yes. Illegal, no. To threaten or intimidate rather than fix the fault is reliance on the ancient Microsoft trope security through obscurity. Tolerance of that oppressive behavior makes us less secure, not more.
Closing their account on your service is fair game though. No obligation to host anyone for any reason.
Dealing with aggrieved customers is just a part of doing business with the public. No matter how well you behave some people just have issues, and some will have legitimate complaints. Microsoft is a multitrillion dollar multinational corporation. That comes with the turf.