>https://cogecog.com/the-threat-onion/
See the onion model. You are raising awareness of a vulnerable target. I can argue that you are increasing risk, it's a reasonable argument regardless of whether you can defend it. You are introducing a liability to yourself of being civilly liable for damages and criminally responsible, all this for no gain except some possible altruistic desire to improve security. It's a categorical error.
I find the policy of not increasing awareness to a vulnerability is more consistent with my desire to improve my personal position, I do not get involved unless there's something that benefits me. Raising awareness benefits the consumers of these websites, while damaging the owner, which may be an ethically positive action under your paradigm, but it also damages your personal position.
This is akin to saying HIBP shouldn't tell you which addresses are affected by hacks/leaks cause that points attackers in the direction. They already know and not disseminating information doesn't prevent that.