That might serve to provide incentives to the vendors who aren't already working actively on their security to do so, and also reduce (although obv. it wouldn't eliminate) the number of vulns going straight to offensive products.
Why would I take the market route?
Defensive work (e.g. IPS vendors) well after they've got their early day protection they can just sell on to the vendor.
Offensive (e.g. "cyberweapons" ugh I had that term). well that's the point I'm making that whole industry is bad for defensive security as it involves keeping vulns secret as long as possible, so they can be used by them.
Gov's have to make a choice whether that's an industry they want to encourage, be neutral to, or discourage.
But given this line of thinking is one you'd disagree with, what option for addressing the problem do you prefer?
If you can't articulate a reasonable and effective regulation that would control vulnerability research, regulation will do more harm than good: it will wipe out beneficial research and drive talent towards malicious research.
It's not on me to come up with a way to "address" the "problem". Doing nothing seems like a more credible response than trying to outlaw specific kinds of computer programming.
Doing nothing would seem like a losing response given the current swing of events but I'll defer to your greater experience.
On "flaws fixed rather than concealed" sure in a perfect world they do, but limited resources == prioritization and some systems and packages inevitably get left behind, insiders know which those are..