Services can negotiate the terms of their insurance contract or even choose whether or not to carry insurance. They agree to these terms and know the implications, and again, if the need for the investigation is legitimate then they should be conducting it regardless of how the vulnerability is uncovered.

> it's not the way the law works.

Which is problematic.