In the U.S. the opposite is encouraged as we lack a lot of safe harbor laws surrounding responsible disclosure. Something as simple as seeing individual's social security numbers hardcoded into HTML could get you dragged through the mud by your state's leaders and the potential threat of jail time.

It's why you'll see a black & white approach to this among bug hunters, instead of a grey / middle-of-the-road one. Some will try to disclose responsibly, the company will deny, and by disclosing through their BBP you've technically agreed to their NDA, so you can't say a word about it even if it still exists a year later. Others will find it and just post it publicly right away, as they don't want to agree to an NDA, and a public action leads to them actually fixing it quickly instead of letting the vuln sit around forever.