Well this is absolute bullshit. You're discussing private software. It's up to the owner to offer a bug program that's enticing enough to debug their own software if they care.

Reporting a vulnerability should be extremely low effort. Regardless of how I feel about a company I wouldn't want users to get screwed. I tried to disclose to google once and they required an account so instead I moved on with my life. I don't care about random people enough to make a google account.