According to German law, a competitor (possibly Visa) can sue a company for uncompetitive behaviour that has the potential to affect the consumer negatively.

This means that at least in theory a security researcher could work as a contractor at a competing firm to then let their legal department send a cease and desist letter and demand recouperation of the legal fees including the money paid to the security researcher to find the vulnerability.

Anyone who quotes me on this in their court case is an idiot.