> but apparently it's the responsibility of whoever finds the vulnerability

Aka a white hat professional which should be a prized function richly rewarded. Do you really want these things to be calcified into a government function?