Project Zero is very well known for things exactly like this. Partially, it's because they are incredibly talented, but there are also talented people in academia and in other security consultancies. The biggest difference with Project Zero is that their primary [0] goal is altruistic: find vulnerabilities, and let people who can fix them know (vs publishing papers, securing paying clients, auctioning zero-days, etc), in the interests of making the internet and computing as a whole a safer place.
[0] Their secondary goals are to protect Google products and services, and to provide excellent PR in line with what we're discussing right here.
[0] Their secondary goals are to protect Google products and services, and to provide excellent PR in line with what we're discussing right here.