I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments:

- Discovery didn't create the bug. You have no idea who has been exploiting the shit out of it already.

- Vendors will have all sorts of unreasonable responses, from ignoring you to threatening legal action to dragging their feet.

- Vulns are work product. You are entitled to zero of the researcher's time and effort unless you're paying them for it.

I'm not saying coordinated disclosure is bad either! I prefer to do it when I find stuff. We found a bug in NextJS last week and we did coordinated disclosure (I'm talking about it now because they released a fix). I'm saying the researcher owns the bug.

EDIT: Oh no! Of course he beat me to it.