Comment by cjbprime

For the researcher? Because the vendor has a responsible disclosure program. Because they'd rather know about the bugs.

(As for the vendor, I'm sympathetic to the argument that there should be vendor liability under some circumstances.)