That's going to be on the order of thousands or tens of thousands of bugs per year for each large company. It also discourages businesses from performing pentests since finding anything leads to shitty press. And this is largely useless information since it gives no info about unknown bugs. This makes it seem like small companies with no security apparatus are actually safer because all of their bugs remain unknown.

Okay ... and how to enforce this ?

Because reality is that this would essentially require policing every commit that ever makes it to public serving in every company.

To call that unreasonable is vastly understating matters.

I'm not advocating any external enforcement action. Merely taking the position that if there's an internal conversation which goes along the lines of 'that vulnerability could have been really bad but based on what information we have it doesn't look like it's been exploited... should we tell anyone?' then the answer should be yes, it should be disclosed. That sounds like pretty much the conversation that happened inside Google only they decided 'no, better not... we might get in trouble'. That's a red flag right there.