> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other?

Were this actually the case, the CSV list (not even mentioning Google's own Project Zero) would have disincentivized companies and projects years ago.