There are a lot of examples in the US of the government harrasing citizens who report vulnerabilities. The DMCA is typically used to justify this behavior.

I'm not sure what the appropriate conclusion is here.