"discovering vulnerabilities in devices in order to extort their owners, even if claimed as “research,” is not in good faith."

If I had just discovered a vulnerability, and didn't have a written contract authorizing me to do the research, I wouldn't feel the least bit of additional protection from this policy change, and would probably refrain from extorting the owner.

Edit: I had read "extorting" as "extolling" and associated with notification, not extortion. (I even typed "extorting" in this response.) I stand corrected, as extortion changes the tone of the qualification.