I think it's not just the UK. In fact, in many countries you don't have enough protections for security researchers. So no one bothers reporting these things because it would get you in trouble.