I'm sure that lots of HNers including myself have encountered security vulns in different proprietary pieces of software that we encounter.

I can think of at least two or three occasions where I discovered an exploitable vuln, didn't have a contact to report it to, decided I didn't want to have the back-and-forth of some non tech company threatening me with a lawsuit, and took no further action (typically for lower severity vulns in less important services).

With open source software you can hop on GitHub and dig deeper into a vuln or other bug and actually report it somewhere.