The "we can't possibly write good laws" attitude is, IMO, a significant part of why we don't write good laws in the US.

You may be right, but I suspect the causality is reversed: maybe there's a widespread sense that good laws cannot be written because, empirically, the people who make laws do so in devastatingly dumb ways.

Whatever issue will immediately become a political football, and will end up being not only ineffective at the initial intention, but also include terrible side effects and dangerous footguns. Whether this is the result of a basically broken system of legislature, or of allowing the laws be drafted by the people they are supposed to protect against, or a combination of both, or something else entirely, I'm not qualified to say.

But I can say this: when I hear of some political ambition to make something better with a new law, I don't expect it to go well.

When I hear of some political ambition to make something better through inaction or through demolishing Chesterton's Fence, I don't expect it to go well.

It's also a product if writing good laws is really hard because the people writing them are outside the industry, different from the people enforcing them, and often different from the people it affects.

Better to remove barriers and things that silo and centralize power.

Which is why lobbying ostensibly exists: people in the industry know best.

To counteract this a consumer group or union of those affected would be required, but that's a bit tough when they are usually the ones spending the money, not earning it.

It doesn’t seem hard to get right:

If someone discovers a security vulnerability in a computer system, and they notify the operator or party responsible for maintenance of the system, then, starting 90 days after the notification was received, they may publicly disclose the vulnerability without fear of civil or legal repercussions.

If they use the vulnerability to exploit a system that is outside of their own administrative control (beyond developing a proof of concept), or transfer the information with intent to facilitate third party exploitation of the vulnerability, then the above protections do not apply.

I’m sure a lawyer worth their salt could turn that into an iron-clad law.

This is a good example of how laws can be difficult to craft; your proposed legislation wouldn't cover this case.

It wasn't the public disclosure Chase retaliated over here. The disclosure came after the retaliation.

That’s why you have to create a disclosure system that incentivizes use. It’s very difficult to protect someone who has not come forward.