Sometimes grandstanding makes sense.
"We're not going to charge people for security research", might reduce the chilling effects of some company threatening some rando researcher.
"We're not going to charge people for security research", might reduce the chilling effects of some company threatening some rando researcher.
Seems the rando researcher is subject to the same liabilities as before.
I don't find that the least bit weird.
If I had just discovered a vulnerability, and didn't have a written contract authorizing me to do the research, I wouldn't feel the least bit of additional protection from this policy change, and would probably refrain from extorting the owner.
Edit: I had read "extorting" as "extolling" and associated with notification, not extortion. (I even typed "extorting" in this response.) I stand corrected, as extortion changes the tone of the qualification.