Adding legal agreements into a technical standard is tricky. Security researchers absolutely need protection, but it should be addressed at via legislation. There needs to be a clear way to distinguish security research from malicious hacking that applies across technologies.