I would not agree that this is extortion. I would consider it to be more self-protection. If you have no intention of misuse or public release of the security flaw to the public; you are offering a no harm approach while offering a valuable service. The unfortunate situation is that the business in question does not value the service even though they should.

Most competent programmers do not have time to just go around and fix every security flaw pro bono either.

I understand it's not extortion. You'll note I never said it was extortion.

I also understand how it protects the reporter.

I'm not asking the reporter to take responsibility or do anything that would harm them, I'm asking them not to essentially make the sales pitch of "look at how your neighbor had something bad happen to them, you wouldn't want something similar to happen to you now would you?"

"It's certainly pretty tasteless."

While debatable (depends on execution) whether it is tasteless to make money you sometimes have to get over that.

"I wouldn't consider doing business with someone who applied that tactic."

The person doing the sending isn't looking to close 100% of the people he mails to. Nor does he care what the recipient thinks. If you worry about that you will potentially miss a business opportunity.

Look think of it like using a cheezy line in a bar. Something that I've never done but I recognize that it works for some people and gets them dates. In the end approaching 100 women with a line will work better than staying home and doing nothing (assumes you can take the rejection of course).