> From a distance, white hat "vulnerability disclosures" start to look like a protection racket.

A pretty big distance.

If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket.

If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.