Also, even if it’s true, why does the company get to command the researcher’s time?

Finally, as a company, you get to mitigate this by having a serious disclosure policy. It helps if you don’t look like the bad guys.

I'm not going to link to specific github issues but I've seen enough people dropping "vulnerabilities" and yelling at the developers. (I'm pretty sure you know what I'm talking about.) This often gets the developers worked out and gives security people a bad rap. It's a lose-lose situation imo. People need to learn empathy and stop blaming developers.

Of course there are companies that need to be shamed, and that will repeatedly act shady, but too many people use this to excuse their behavior in general.

A direct example is right here - ArtChain is now completely unusable because someone decided it would be funny to redirect their homepage to Pornhub. Sure, they had it coming, but I'd wager at least a few readers here had to hurried explain to a coworker why they were looking at porn at work.

(Granted, it's not a good example, because the researcher in question did reach out, and the incompetent idiot showed his ass to the entire internet, but immediate full disclosure would have had the same effect.)

I also agree that just sitting on the vuln and pleading with an idiot is not a productive use of anyone's time.