A public spat between Microsoft and an independent security researcher reopens a long-running debate over who is responsible for securing software.