If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.
Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.
Even if the company ends up paying damages, it’s too late for the true victims.
Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.
The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."
To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.