Considering you tried to get into contact with this organization multiple times and didn't get any real engagement until you called them a botnet, I wouldn't really call you prior work "poor investigative reporting on our part".

The lack of information they can provide about their user base and how their software is distributed honestly raises my suspicions of them. You don't make a product and then not know how people get it or what they think of it, that's just bad business.