If they’re not willing to break an NDA for it, it can’t be all that serious.
Maybe they are willing to break the NDA and they're just trying to go this route first.
Look what happened to many people who broke NDAs or helped to do so. Snowden is stuck in Russia. Assange got holed up in an embassy for years. Sarah Wynn-Williams, the Facebook/Meta whistleblower, got an insane court order against her [1].
Theoretically, retaliating against whistleblowers is seriously illegal stuff. But in practice these regulations are seldom enforced. And even if your (former) employer does not retaliate openly, there might still be "invisible" retaliation, or the risk of other large employers just blacklisting you by default.
You'd be willing to destroy your career to publish a warning no one will need?