Comment by robocat

Sure - that's a bug bounty - which is opt-in.

You said "There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all..."

So what you said is wrong, right.