provoost on Nostr: I guess for next time it might have been better to first email them and ask if it's ...

I guess for next time it might have been better to first email them and ask if it's ok to demonstrate the issue. If they then don't respond, it's still defendable to demonstrate the issue anyway: since it's likely that a malicious actor would figure it out sooner or later and do far more damage.

This does rest on the assumption that your demonstration itself wouldn't draw lots of attention. Which it might have if they had found a very old stale block. So your other suggestion, to use the most recent block, would have been safer. In hindsight anyway. But also more difficult to pull off IIUC.