I guess a problem with this is stating where the line is drawn. It might be difficult to promise not to sue well-intentioned researchers without reducing their ability to sue people with malicious intentions.
One solution might be using an agent - setup a clearing house for security issues run by a couple of trusted people. You log the issue, the clearing house gets in touch with the company and gives them access to the issue details.
It keeps the person reporting the issue one step away from the company and any potential trouble.
Once the company acknowledges and fixes the issue it is made public with an optional credit
If they don't acknowledge the issue it becomes public anyway after x days.
I don't know many (I certainly don't) who use their real IP when probing sites
a) I'm not sure how they'll react (will they claim I'm trying to extort them?)
b) there's never any clear way to contact a company beyond calling/emailing 'customer support'.
Occasionally I've tried to poke around my linkedin network to see if I had a connection at company X to reach out to their dev team and notify them of something, but I've never been successful that way (but also haven't pushed the issue much).