This is a rather common tactic, they spam out automated security reports, and request a payment for their "services" from those who reply and engage further with them.

On a related note, I often feel uncomfortable reading about a responsible disclosure, and find coordinated disclosure to be a much more balanced term in the context of disclosing security vulnerabilities.