Some government -- anywhere in the world -- should offer a responsible disclosure service. You disclose to them a vulnerability, anonymously (e.g. via Tor) if you prefer, then they notify the target and impose a reasonable remediation deadline before publication.
And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.
And then they would all do it because everyone would prefer that they rather than a foreign government are the ones holding 0-days during the remediation period.