Imagine if the police had prior knowledge of a vulnerability in the computer system of a car, but did not act to protect the public. A few years later a criminal figure out the same vulnerability and causes a major car crash on a motorway and murder several people. I would view the police officer to be found liable under breach of duty, same as if they witnessed a crime and refused to act.
Under the same logic, if companies has a legal responsibility to protect their customers and provide safe products, and police officers has a professional responsibility to report crimes, then the police should be forced to act if they have confirmed information about a security vulnerability.
Since 1 January there is also a law in the Netherlands that requires companies to report any data leaks.
https://www.government.nl/latest/news/2015/07/10/obligation-...
I was thinking about this when Anonymous "hacked" thousands of ISIS twitter accounts. On the one hand that saves Twitter from having to make a stand themselves - but if they didn't immediately plug those holes, they're leaving legitimate users at risk.
Also, one very bothersome side effect of government-sanctioned hacking is that governments have an incentive not to notify software vendors about vulnerabilities.