Incorrect, if you find a vulnerability and make that public, and point attackers towards them, you are making it more likely they are attacked, and thus making them more vulnerable.

This is akin to saying HIBP shouldn't tell you which addresses are affected by hacks/leaks cause that points attackers in the direction. They already know and not disseminating information doesn't prevent that.

>https://cogecog.com/the-threat-onion/

See the onion model. You are raising awareness of a vulnerable target. I can argue that you are increasing risk, it's a reasonable argument regardless of whether you can defend it. You are introducing a liability to yourself of being civilly liable for damages and criminally responsible, all this for no gain except some possible altruistic desire to improve security. It's a categorical error.

I find the policy of not increasing awareness to a vulnerability is more consistent with my desire to improve my personal position, I do not get involved unless there's something that benefits me. Raising awareness benefits the consumers of these websites, while damaging the owner, which may be an ethically positive action under your paradigm, but it also damages your personal position.

This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.

I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.

Just give them the deets.

Certainly a touchy subject, but in the end, the security researcher is better off "risking" being seen as an extorter, than simply having no revenue mechanism.

You're trying to assert authority and make money off of what is super basic cybersecurity. I'm not sure why you think word of mouth would cause anyone to do anything but laugh at you at best, or get the law after you at worst.