The fact you're asking that question at all...should answer your question. Plus they should be able to ask a supervisor or google or chatgpt what ORC is. I would fire that email you received back to Air NZ requesting further education/reminders to staff to read previous responses and instead of putting the onus back on the customer to explain ORC, maybe ask internally and maybe they could get the status right of the passenger enquiring.

But also I would email back with your clarifications and maybe ask that they share that information amongst their peers (so others don't have to go through the same thing. You don't need everyone to make the same mistakes, they should share their mistakes so everyone can learn from them. It would improve the customer experience).

Though talking about the elite email. Was asked for the following as security questions. That is all public information. Not a security question. (Well for me the email address is semi private as I use a mixture of catch alls and + addressing to make uniqueish email addresses. But most people it is public information)
• Date of birth
• Postal address
• Email address
• Phone number(s)

Once get the things sorted might drop some feedback that those are not security questions they are public information.