> Why could he not speak to HIS ceo himself instead of asking Bob to

You can't expect a founder/CEO to spend 2 minutes relaying an email with critical security information to his own CTO, he's surely way too busy disrupting and pivoting and doubling down on product market fit.