You are crazy if you think that legislators are going to do a better job of designing a policy to regulate vulnerability researchers than technologists will. Whatever the policy would end up being, it will be asymptotically as effective and reasonable as whatever we talk about here.

If a bunch of technologists (including vuln researchers) can't define a reasonable policy, I think it's a pretty safe bet that there's no reasonable policy to be had.