I think a good solution would be a generally accepted security flaw reward contract. If most corporations with an online presence adopted some uniform agreement, we'd have a standardized method of report and reward.
In this case, I'm more worried about the "lots to lose" part than about the "nothing to win" one. For some reason I'm even fine with doing charity work for the benefit of billion-dollar corporations from time to time [1]. But not if there's the risk of them coming after me in the future...
[1] http://technet.microsoft.com/en-us/security/cc308589.aspx