>Charging them to detail the infection to them risks coming off as extortion to less savvy site owners

Certainly a touchy subject, but in the end, the security researcher is better off "risking" being seen as an extorter, than simply having no revenue mechanism.