If he had gone to the government first, they would have instantly had a judge impose a gag order on him, on the reasoning that talking about the vulnerabilities would compromise "national security". Then the government would have sat on the data.
Going to media FIRST ensures that it will be taken seriously.