I recently visited the website for a large, reputable company which serves a malicious script (it's a knockoff of one of the major analytics apps, with an inconspicuous, intentional typo in the source URL). Additionally, the company serves a niche market, and likely doesn't have a large tech team, so their website hadn't been set up with HTTPS.
Fortunately, my antimalware software blocked the script, so I decided to look around at least the landing page to see if there's some kind of administrative (or even support) contact.
Not having found one, and not having found anything useful after doing a WHOIS query, I noticed that they accept Facebook messages via their official page.
Is it generally risky to notify a company of a vulnerability using such unofficial channels?